Client Guide

Connecting Google Workspace

Easy Cyber Protection reads your Google Workspace as one of your super admins, through its own service account. You give that service account read-only access in Google Admin. There is no key to create, download or upload.

Nederlands · Français

What you need

A super admin of your own Google Workspace domain, for example admin@yourcompany.com.

A personal mailbox does not work: gmail.com, outlook.com, hotmail.com, telenet.be, skynet.be, orange.fr and similar addresses belong to no Workspace domain, so Google always refuses them. The connect form tells you while you type, before anything is sent.

Give access in Google Admin

  1. Sign in to admin.google.com as a super admin.
  2. Go to Security, Access and data control, API controls, Manage Domain-wide Delegation and click Add new.
  3. Client ID: 110576318557147009665. The connect form shows it with a copy button.
  4. OAuth scopes: paste the list from the connect form. Every scope is read-only. Only the users scope is required. Each other scope adds evidence.
  5. Click Authorize.

Connect

Open IT environment, Integrations, pick Google Workspace and click Connect. Enter the email address of the super admin. Leave Customer ID empty: Easy Cyber Protection then reads the Workspace account that admin belongs to. It changes nothing in your Workspace.

When Google refuses

Do you see Google refuses access for this administrator? Check in admin.google.com:

  • Domain-wide delegation exists for client ID 110576318557147009665.
  • Every scope from the list is pasted.
  • The address you entered is a super admin of your own domain.

The message shows the client ID and admin address it used. Compare them with Google Admin.

Connected, but some evidence is missing

Google Workspace is connected, but the delegation in Google Admin holds only part of the scope list. Easy Cyber Protection reads what it may and skips the rest, so the evidence from the missing scopes stays empty. The card lists what is missing and how to add it:

  1. Sign in to admin.google.com as a super admin.
  2. Go to Security, Access and data control, API controls, Manage Domain-wide Delegation.
  3. Find the row with client ID 110576318557147009665 and click Edit.
  4. Replace everything in OAuth scopes with the list below and click Authorize. The list also holds the scopes you already gave, so nothing is lost. Every scope is read-only.
  5. Back in Easy Cyber Protection, click Sync now on the card. Google sometimes needs a few minutes; otherwise the daily sync picks it up.
https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/admin.directory.orgunit.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.reports.usage.readonly,https://www.googleapis.com/auth/cloud-identity.policies.readonly

The card shows the same client ID and list, each with a copy button.

Connections made with your own key

Connections made before October 2026 with your own service-account key keep working. You do not need to change them. Easy Cyber Protection no longer asks for a key, so there is nothing to paste.

"Not updated since" on the card

Easy Cyber Protection syncs every connection once a day. If no sync has succeeded for two days, the card shows Not updated since with the date of the last successful sync. The data from that sync still counts for 30 days after it, then it stops counting. Press Sync to try again; if it fails, the card shows why.

IT environment

Integrations, inventory, and size

Audit

See what is missing, per control