Skip to main content
Connect Google Workspace to give Porcia organization-wide visibility into applications, users, groups, delegated access, and supported vendor signals. You can start this setup during onboarding or later from Settings → Integrations. If you signed up with Google, Google Workspace is the provider shown first during onboarding; signing up with Google alone does not grant Porcia organization access.

​
Before you start

  • You are a Google Workspace Super Admin.
  • You can create or use a Google Cloud project.
  • You can create a service account and download its JSON key.
  • You can authorize domain-wide delegation in the Google Admin Console.
  • Allow approximately 10 minutes for setup, plus any provider propagation time.
If you are not a Super Admin, share this guide with the administrator who can authorize the connection.

​
Connect Google Workspace

1

Start the Google Workspace connection

In onboarding or Settings → Integrations, choose Connect Google Workspace. Porcia opens a guided setup with the access categories required for organization-wide discovery.
2

Create or select a Google Cloud project

In Google Cloud, create or select the project that will contain the service account. Enable the Google Workspace APIs requested by the setup guide.
3

Create a service account and key

Create a service account and download its JSON key. Keep the key private and upload it only through the Porcia setup flow.
4

Authorize domain-wide delegation

In the Google Admin Console, authorize the service account’s client ID under the domain-wide delegation controls. Copy the scopes shown in Porcia exactly.
5

Upload and verify

Return to Porcia, upload the service-account JSON key, provide the administrator mailbox if the setup asks for one, and choose Verify and continue.
After verification, Porcia begins the initial synchronization. Results appear progressively in the application inventory and related governance views.

​
Access requested

Google Workspace uses five domain-wide delegation scopes for the supported organization-wide connection: These permissions help Porcia connect people, groups, applications, activity, delegated access, and relevant vendor signals. The exact results depend on your Workspace configuration and the data available in the connected tenant.
The Google Workspace connection is organization-wide. Employees do not need to connect individual Gmail accounts for this supported setup.

​
What Porcia can show

Application context

Applications associated with Google Workspace and their available access context.

Users and groups

Organizational context for understanding who has access to which applications.

OAuth activity

Third-party authorization and delegated-access context for risk review.

Vendor signals

Relevant mailbox signals such as invoices, renewals, signups, and permission notices.

​
What Porcia does not do through this connection

  • It does not send email from customer mailboxes.
  • It does not change Google Workspace users, groups, or application assignments as part of discovery.
  • It does not require every employee to complete an individual connection.
  • It does not use the connection as a general browsing or page-content monitor.
Any separately supported administrative action requires the relevant permission and an explicit confirmation in the product.

​
If setup is skipped

You can return to Settings → Integrations and start the Google Workspace connection later. If your organization cannot complete the administrator setup, ask your Google Workspace administrator to follow this guide.

​
Troubleshooting

​
The connection cannot be verified

  • Confirm the service account JSON key belongs to the service account whose client ID was authorized.
  • Confirm domain-wide delegation is enabled for the correct Workspace domain.
  • Confirm the scopes in Google Admin Console exactly match the scopes shown in Porcia.
  • Allow time for Google changes to propagate, then retry verification.

​
No applications or vendor signals appear yet

Initial synchronization is asynchronous and may take longer for larger organizations. Confirm the connection is active in Settings → Integrations, then contact [email protected] with the provider status. Never send service-account keys or private mailbox content to support.

​
Disconnect Google Workspace

  1. Go to Settings → Integrations.
  2. Open the Google Workspace connection and choose Disconnect.
  3. In Google Admin Console, remove the service account’s domain-wide delegation authorization if you want to revoke provider access completely.
Disconnecting stops new synchronization. Historical application data follows your workspace’s supported data-management process.

​
Next steps

Microsoft Entra ID

Connect another organization provider.

OAuth Grants

Review delegated third-party access.

Browser Extension

Add browser usage context.

Findings

Review security and access concerns.