​

Connect Google Workspace to Porcia

Connect your Google Workspace to automatically discover all applications your team accesses via Google SSO.

​

Prerequisites

• Google Workspace admin account
• Super Admin privileges in Google Workspace
• 5-10 minutes for setup

​

What Porcia Will Discover

Once connected, Porcia will discover:

​

Step-by-Step Setup

​

Permissions Explained

​

What We Can Access

User Directory (Read-Only):

• ✅ User names and email addresses
• ✅ Group memberships
• ✅ Organizational unit structure
• ✅ User status (active/suspended)

Application Catalog (Read-Only):

• ✅ SAML applications configured
• ✅ OAuth applications with access
• ✅ Application names and logos
• ✅ User assignments to applications

Usage Reports (Read-Only):

• ✅ Login events and frequency
• ✅ Application usage statistics
• ✅ User activity patterns
• ✅ Security and audit logs

​

What We CANNOT Do

• ❌ Modify users - We never add, remove, or change users
• ❌ Change permissions - We never modify app access or permissions
• ❌ Access user data - We never read emails, files, or personal data
• ❌ Modify applications - We never change SSO configurations
• ❌ Send emails - We never send emails on behalf of users

​

What Gets Discovered

​

SAML Applications

Examples of SAML apps Porcia will find:

• Salesforce
• Slack
• Zoom
• Atlassian (Jira, Confluence)
• Adobe Creative Cloud
• Okta (if using as secondary IdP)

Information extracted:

• Application name and logo
• Vendor identification
• User assignments
• Login frequency
• Last access date

​

OAuth Applications

Examples of OAuth apps Porcia will find:

• Third-party apps with Google Drive access
• Apps using Google Calendar integration
• Apps with Gmail API access
• Google Workspace Marketplace apps

Information extracted:

• Application name and permissions
• OAuth scopes granted
• User consent status
• Usage frequency

​

User Access Patterns

Analytics Porcia provides:

• Most used applications by team
• Unused application licenses
• Login frequency distribution
• Access pattern anomalies
• Shadow IT detection (apps added without IT approval)

​

Troubleshooting

​

Connection Failed

Error: “Access denied”

• Ensure you’re signing in with a Super Admin account
• Check that the admin account has all necessary privileges
• Try signing out of all Google accounts and signing in again

Error: “This app isn’t verified”

• Click Advanced → Go to Porcia (unsafe)
• This is a standard Google warning for newer applications
• Porcia is safe and only requests read-only access

Error: “Admin consent required”

• Your organization may require admin approval for new apps
• Contact your Google Workspace administrator
• They may need to pre-approve Porcia in the Admin Console

Pre-approve Porcia in Google Admin Console

If your organization requires pre-approval:

1. Go to Google Admin Console → Security → API Controls
2. Click Manage Third-Party App Access
3. Click Add app → OAuth App Name or Client ID
4. Search for “Porcia” and click Select
5. Select Trusted and click Configure
6. Choose which organizational units can access Porcia
7. Click Finish

After pre-approval, users can connect without additional admin consent.

​

No Applications Discovered

If no applications appear after sync:

1. Wait longer - Large organizations can take 10-15 minutes for initial sync
2. Check SSO usage - Verify your organization actually uses Google SSO for third-party apps
3. Verify admin permissions - Ensure the connected account has Super Admin privileges
4. Check organizational units - Porcia may only have access to specific OUs

​

Sync Stopped Working

If sync stops after working initially:

1. Check connection status - Go to Settings → Integrations → SSO
2. Reconnect if needed - Click Reconnect if status shows “Disconnected”
3. Check admin account - Verify the admin account is still active
4. Check API limits - Google has API rate limits; sync will resume automatically

​

Google Workspace Admin Console

​

Viewing Connected Apps

To see all apps connected to your Google Workspace:

1. Go to Google Admin Console → Security → API Controls
2. Click App access control
3. View Third-party apps with account access

​

Managing App Access

To control which apps can access your Google Workspace:

1. Go to Google Admin Console → Security → API Controls
2. Click Manage Third-Party App Access
3. Configure access for each app (Trusted, Limited, Blocked)

​

Audit Logs

To view audit logs for app access:

1. Go to Google Admin Console → Reporting → Audit and investigation
2. Select OAuth Token or SAML events
3. Filter by application or user

​

Data Sync Frequency

Initial Sync:

• Complete application catalog
• All user assignments
• 90 days of login history

Ongoing Sync:

• Applications: Daily (new apps, configuration changes)
• User assignments: Daily (new users, permission changes)
• Usage data: Daily (login events, activity)
• Real-time events: Via webhook (if available)

​

Privacy & Security

​

Data Storage

• User directory - Names, emails, group memberships (encrypted)
• Application catalog - App names, logos, configurations
• Usage analytics - Login events, frequency (anonymized in reports)
• Access patterns - User-to-app relationships

​

Data Protection

• Encryption - AES-256 at rest, TLS 1.3 in transit
• Access control - Only workspace admins can view detailed user data
• Audit logs - Complete audit trail of all sync activity
• Token security - OAuth tokens stored securely with encryption at rest

​

Compliance

• Data privacy - Right to access, delete, and export data (GDPR compliance in progress)
• Industry-standard security - Follows security best practices for cloud integrations

​

Disconnecting Google Workspace

To disconnect your Google Workspace:

1. Go to Settings → Integrations → SSO
2. Find Google Workspace connection
3. Click Disconnect
4. Confirm disconnection

​

Revoke Access in Google

To completely revoke Porcia’s access:

1. Go to Google Admin Console → Security → API Controls
2. Click Manage Third-Party App Access
3. Find “Porcia” in the list
4. Click Block or Remove

​

Next Steps