Connect Google Workspace

Sorvek reads Google Workspace through a service account that you create in your own Google Cloud project. A super admin authorizes this account, in the Google Admin console, to act on your domain with a precise list of scopes (domain-wide delegation). You then paste the service account key into Sorvek, which tests each module before saving it.

Before you start

You need:

• In Sorvek: the Administrator role in your organization. See Roles and access.
• In Google Cloud: the right to create a service account and its key in a project, and to enable APIs in it.
• In Google Workspace: a super admin account. It authorizes the delegation, and its address is the account on whose behalf Sorvek queries the directory.

Steps

1. In Sorvek, open Settings > Data sources > Add a source, then choose the Google Workspace Service account (BYO) option.
2. In 1. Select the modules, keep at least Directory and Third-party OAuth apps (checked by default). Add Sign-in & activity logs if needed, and Gmail to discover SaaS accounts through email metadata. The scopes table updates based on your choices.
3. In the Google Cloud console (link in the 2. Create the service account + authorize delegation section), create a service account. No role is required. Enable the Admin SDK API on the project, and the Gmail API if you checked Gmail.
4. In the service account's Keys tab, add a key in JSON format and download the file.
5. Find the service account's numeric client_id. It is in the JSON file.
6. Open the domain-wide delegation page of the Google Admin console (link in the same Sorvek section). Add a new client with this numeric client_id.
7. In Sorvek, click Copy the scopes (DWD console format, comma-separated), paste the list into Google's OAuth scopes field, then authorize.
8. In 3. Google credentials, fill in Name (label), Primary domain (for example acme.com) and Email of a super admin to impersonate (delegation), then paste the complete JSON file into the Service account JSON key field.
9. Click Test & Save. Sorvek obtains a delegation token for each module, makes a representative read call and shows the Result by module.
10. Click Back to list, then Enable next to the new source. Without this step, the source exists but does not feed the views.

A module whose test fails is not saved. If none passes, nothing is created. The JSON key is encrypted at rest and never logged.

What happens next

Once the source is active, it is picked up by the nightly run, which starts every day at 2:30 a.m. UTC (9:30 p.m. or 10:30 p.m. in Montreal, depending on the season). Organizations go through it one after another: the exact time of your scan varies.

On each run, Sorvek syncs the directory (users, 2-Step Verification status, groups and members), then, depending on the saved modules:

• Third-party OAuth apps: the list of third-party applications each employee has given access to;
• Logs: the latest activity of this access over the last 180 days, and its revocations;
• Gmail: email headers (sender, recipients, subject, date, labels). The body of a message is neither requested nor received. The history is caught up gradually, from one run to the next. The user and domain exclusions on the Email analysis page apply.

The details of each scope are in Requested permissions. To follow the first scan, see Your first week.

Check, renew or remove access

• Permissions (on the source's card) checks the delegation scope by scope. Manage delegation opens the Google Admin console, and Re-check runs the check again.
• Renew secret replaces the service account key. The new key is tested before it is saved.
• Disable suspends collection for the active source without deleting anything.
• To cut access on the Google side, remove the client from the domain-wide delegation page, or delete the key or the service account in Google Cloud. See Disconnect Sorvek.