Google Workspace Directory setup guide

Agents help with people, candidates and hiring.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open Google Workspace Directory, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

Google Workspace Directory can be connected 2 ways. Where there’s a key or token to paste, that’s usually the quickest.

Google service account with domain-wide delegation

Service account.

1. In Google Cloud console (https://console.cloud.google.com), create or choose a project and open APIs & Services > Library. Enable the Admin SDK API.
2. Open IAM & Admin > Service Accounts and create a service account. On its Keys tab, choose Add key > Create new key > JSON and paste the file's contents here. Organizations created on or after May 3, 2024 block key creation by default; an organization admin has to allow it for this project.
3. Copy the service account's Client ID. In the Google Admin console (https://admin.google.com) open Security > Access and data control > API controls > Manage Domain Wide Delegation > Add new, paste the Client ID and add the scopes https://www.googleapis.com/auth/admin.directory.user.readonly and https://www.googleapis.com/auth/admin.directory.orgunit.readonly.
4. Enter the email address of a Google Workspace admin to act as. A role with read access to users and organizational units is enough.

Field	What to enter
Service account key (JSON file contents)	A secret: Everdeck saves it encrypted and never shows it again. Where to find it.
Admin to act as	Email address. For example [email protected]. A Google Workspace admin whose role can read users. The Admin SDK answers only for an admin.

The scopes Everdeck asks for:

• https://www.googleapis.com/auth/admin.directory.user.readonly
• https://www.googleapis.com/auth/admin.directory.orgunit.readonly

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at Google Workspace Directory until you delete or rotate it there.

Your Google OAuth app

Your OAuth app.

This way signs in with an OAuth app you create for Google Workspace Directory, as its steps describe: Everdeck never uses an app of its own. Register this redirect URI with your app:

https://app.everdeck.io/api/oauth/callback

Then save the app’s client ID and secret in Everdeck, on the connect page or under OAuth apps, and sign in.

1. In Google Cloud console (https://console.cloud.google.com), create or choose a project, open APIs & Services > Library and enable the Admin SDK API.
2. Open Google Auth platform > Branding and fill in the app name and support email. Under Audience, choose Internal. An External app left in Testing gets refresh tokens that expire after 7 days.
3. Under Data Access, add the scopes https://www.googleapis.com/auth/admin.directory.user.readonly and https://www.googleapis.com/auth/admin.directory.orgunit.readonly.
4. Under Clients, choose Create Client > Web application and add the authorized redirect URI https://app.everdeck.io/api/oauth/callback.
5. Copy the Client ID and Client secret into the form, then sign in as a Google Workspace admin whose role can read users and organizational units.

The scopes Everdeck asks for:

• https://www.googleapis.com/auth/admin.directory.user.readonly
• https://www.googleapis.com/auth/admin.directory.orgunit.readonly

When you disconnect, Everdeck asks Google Workspace Directory to revoke the sign-in, then deletes the tokens it saved.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• List usersTier 0 · ReadReads outside contentgoogle_directory_list_users

  List the Google Workspace users of your organization, or of one organizational unit and the units under it. Returns id, primary email, name, whether the account is suspended, organizational unit, job titles and departments, and manager (relations of type manager, by email).

• Find people by name, email or titleTier 0 · ReadReads outside contentgoogle_directory_find_users

  Search the organization's users by name, email or job title (prefix matches), for example name:'Jane' or orgTitle:'Head of Finance'. Returns the same fields as list_users.

• Read a userTier 0 · ReadReads outside contentgoogle_directory_get_user

  Read one user by primary email, alias or id: name, organizational unit, titles, departments, cost centers, locations, manager and whether the account is suspended.

• List a user's aliasesTier 0 · ReadReads outside contentgoogle_directory_list_user_aliases

  List the other email addresses (aliases) of one user.

• List organizational unitsTier 0 · ReadReads outside contentgoogle_directory_list_org_units

  List the organization's organizational units, every level under the one named (the whole organization when none is). Returns each unit's name, path, description and parent path.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If Google Workspace Directory later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit or Reconnect.

To stop agents using Google Workspace Directory, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.