Skip to content
English - United States
Get Support Now
Contact us
  • There are no suggestions because the search field is empty.

Integration Guide: Google Workspaces

Learn How to Connect the Monday Integration

Published Date: June 8, 2026 | Last Updated: July 1, 2026

 

Overview

The Google Workspace integration connects Tello IAM to your Google Workspace directory using a Google Cloud service account with domain-wide delegation. The connection requires a service account key (JSON), Directory API access authorized in the Google Admin console, and a Workspace administrator email for impersonation.

Before connecting

The Administrator completing this setup needs 2 levels of Google access: the ability to create a project and service account in Google Cloud Console, and super administrator access to the Google Workspace Admin console for the domain being connected. The domain-wide delegation step must be completed in the Admin console of the same Workspace tenant entered in the Tello IAM configuration dialog.

Step 1: Enable the Admin SDK API in Google Cloud Console

  1. Sign in to Google Cloud Console and select or create a project using the project picker in the top bar.
  2. Navigate to APIs & Services › Library and search for Admin SDK API.
  3. Select Enable.

Confirmation: The Admin SDK API product page displays API Enabled.

Step 2: Create a service account and key

  1. Navigate to IAM & Admin › Service Accounts.
  2. Select + Create Service Account.
  3. Enter a name (for example, tello-iam-sync). No project roles are required — skip the optional access steps and select Done.
  4. Select the new service account, then open the Keys tab.
  5. Select Add Key › Create new key, choose JSON, and select Create. The key file downloads to your device.
  6. On the Details tab, copy the service account's Unique ID. This is the Client ID used in Step 3.

Note on Google terminology: Google refers to the same value by 3 different names. The service account's Unique ID (Details tab), the client_id field in the downloaded JSON key file, and the Client ID requested in the domain-wide delegation screen are all the same ~21-digit number.

Important: The JSON key file contains a private key that grants access to your directory. Store it securely, do not share it, and delete downloaded copies after the connection is configured. If the key is ever exposed, delete it on the Keys tab and generate a new one.

Step 3: Authorize domain-wide delegation in the Google Admin console

This step is completed in the Google Admin console (admin.google.com) — not Google Cloud Console — signed in as a super administrator of the domain being connected. These are 2 separate Google products: the Cloud Console manages the service account and key, while the Admin console manages the Workspace domain. The Google Cloud project holding the service account does not need to belong to the Workspace domain being connected — the domain-wide delegation entry is what links the two.

  1. Navigate to Security › Access and data control › API controls › Manage Domain Wide Delegation.
  2. Select Add new.
  3. In the Client ID field, enter the service account's Unique ID from Step 2.
  4. In the OAuth scopes field, enter the following 2 scopes: https://www.googleapis.com/auth/admin.directory.user.readonly and https://www.googleapis.com/auth/admin.directory.group.readonly
  5. Select Authorize.

Note: The readonly scopes above support the default Read-Only edit mode in Tello IAM. If the integration will be configured to write changes back to Google Workspace, authorize the scopes without the .readonly suffix instead.

Step 4: Connect Google Workspace in Tello IAM

The Google Workspace configuration dialog contains 4 tabs. Only the Connection Settings tab requires input — the remaining tabs are pre-populated with defaults appropriate for most organizations.

Connection Settings

  1. Navigate to Integrations in the left navigation.
  2. Select + Add Integration.
  3. Search for Google Workspace and select Add.
  4. Enter a name for the connection in the Name field.
  5. Enter the primary Workspace domain in the Google Workspace Domain field (for example, example.com).
  6. Enter a Workspace administrator email in the Admin User Email field. This is the account the service account impersonates for Directory API access.
  7. Paste the entire contents of the JSON key file from Step 2 into the Service Account Key JSON field. The key is stored securely and is not displayed again.

Synchronization Settings

Review the defaults. No changes are required for a standard connection.

  • Sync Interval (seconds) — how often users and groups synchronize from Google Workspace. Default is 900 (15 minutes). Set to -1 to disable periodic sync
  • User Filter Query — optional Google Directory API query to limit which users sync (for example, isSuspended=false)
  • Group Filter Query — optional Google Directory API query to limit which groups sync (for example, name:Engineering*)
  • Edit Mode — determines whether changes made in Tello IAM can be written back to Google Workspace. Default is Read-Only (Recommended)

User Attribute Mapping

Controls how Google user attributes map to Tello IAM user fields. The defaults are correct for standard Google directories.

  • Username Attribute — default primaryEmail
  • Email Attribute — default primaryEmail
  • First Name Attribute — default name.givenName
  • Last Name Attribute — default name.familyName

Group Attribute Mapping

Controls how Google group attributes map to Tello IAM group fields.

  • Group Name Attribute — default email
  • Group Description Attribute — default description

Select Create Source to save the configuration and connect. The integration appears on the Integrations page and an initial sync begins automatically.

Verify the connection

After the initial sync completes, confirm the following on the Integrations page:

  • The Google Workspace integration displays a status of Active
  • A sync timestamp is present and reflects the completed sync
  • User records on the Users page display synced Google Workspace users and group memberships

Reauthorizing the connection

If the Google Workspace integration loses authorization, it will display an error on the Integrations page. Common causes are a deleted or expired service account key and removed domain-wide delegation. To reauthorize, generate a new JSON key on the service account's Keys tab, confirm the delegation entry still exists in the Google Admin console, then select the integration row in Tello IAM, select Configure, and paste the new key.

Related articles

 

Logo Color-1 Seasoft Security Solutions LLC | Tello IAM