Connect Google Workspace Directory to Rig

Before you start

• You need a Google Workspace super administrator to authorise the service account in the Admin console, and access to a Google Cloud project where you can create a service account.
• Pick an admin in your domain with the Users read privilege. The service account reads the directory as this person.
• Enable the Admin SDK API in the Google Cloud project that owns the service account.

Step 1: Create a service account and key

Do this in your own Google Cloud project. Google's guide on creating credentials covers each screen; the outline is below.

1. In Google Cloud, enable the Admin SDK API for the project.
2. Create a service account and create a JSON key for it. Download the file and keep it safe.
3. Copy the service account's client ID. The Admin console asks for it in the next step.

Step 2: Authorise domain-wide delegation

1. Sign in to the Google Admin console as a super administrator.
2. Go to Security → Access and data control → API controls.
3. Click Manage Domain Wide Delegation, then Add new.
4. Paste the service account's client ID into Client ID.
5. In OAuth Scopes, enter https://www.googleapis.com/auth/admin.directory.user.readonly.
6. Click Authorize.

Step 3: Connect it in Rig

Adding a source needs a workspace owner, or a role with the Manage connections permission, on a workspace where you manage your own connections. If the Connectors tab says “Data ingestion for this workspace is managed by Rig”, ask an owner or Rig support to add the source.

1. In Rig, open Connections, choose the Connectors tab and go to Sources & actions.
2. Search for Google Workspace Directory, open the card and click Connect.
3. Service account JSON key: Paste the whole contents of the JSON key file you downloaded.
4. Admin to act as: The email address of the admin who holds the Users read privilege.
5. Customer ID (optional): Leave it blank to read your own account. Set it only if you need a specific customer ID, which you can find under Account settings in the Admin console.
6. Click Continue. Rig checks the credentials and lists the streams it can reach, so choose the ones you want and click Connect.
7. The source then syncs on its schedule, which is nightly unless you change it. To load data straight away, click Sync on its row; Test pulls a small sample first if you want to check the connection.

What Rig pulls in

Google Workspace Directory lands in its own google_workspace_directory schema in your warehouse:

• Users: one row per Workspace account, with manager, department, title, cost centre, org unit, suspended and archived flags and the account creation time.

Last login time is off by default and Rig only requests it if you tick it. Family relations are never stored, and each sync replaces the table so a deleted account drops out of the directory.

Good to know

• Workspace stores neither start or leave dates nor a team object, so the org unit and the department text are your team fields.
• Rig asks Google for only the columns you have selected, so phones, addresses and recovery details never leave Google.
• If the connection test fails with an authorisation error, check that the client ID and scope in domain-wide delegation match exactly and that the admin you named really holds the Users read privilege.
• To disconnect Google Workspace Directory, click the bin icon on the source's row under Sources & actions. Only whoever connected the source or a workspace owner can do this, and data already synced stays in the warehouse.

What people use this for

• Keep an accurate people directory
• Find stale and suspended accounts
• Join the directory to cost and usage data

More ideas for using Google Workspace Directory

Google Workspace Directory documentation

• Google Workspace: create access credentials and set up domain-wide delegation