---
title: "Connect Google Workspace Directory to Rig — Rig guide"
description: "Connect Google Workspace Directory to Rig with your own read-only service account and sync users, managers, departments and org units into your warehouse."
canonical: "https://rig.so/guides/connect-google-workspace-directory"
format: markdown
---

Search guides, references, playbooks…⌘K

Browse guides

# Connect Google Workspace Directory to Rig

Sync every Google Workspace account with its manager, department, title, cost centre, org unit and suspended or archived state into Rig. The connection uses a service account in your own Google Cloud project with read-only domain-wide delegation, and Rig never asks for phones, addresses or recovery details.

## Before you start

- You need a Google Workspace super administrator to authorise the service account in the Admin console, and access to a Google Cloud project where you can create a service account.
- Pick an admin in your domain with the **Users** read privilege. The service account reads the directory as this person.
- Enable the Admin SDK API in the Google Cloud project that owns the service account.

## Step 1: Create a service account and key

Do this in your own Google Cloud project. Google's guide on creating credentials covers each screen; the outline is below.

1. In Google Cloud, enable the **Admin SDK API** for the project.
2. Create a service account and create a JSON key for it. Download the file and keep it safe.
3. Copy the service account's client ID. The Admin console asks for it in the next step.

The key stays yours
Rig does not provision a service account for this connector. The key lives in your project and you can delete it at any time to cut access off.

## Step 2: Authorise domain-wide delegation

1. Sign in to the Google Admin console as a super administrator.
2. Go to **Security** → **Access and data control** → **API controls**.
3. Click **Manage Domain Wide Delegation**, then **Add new**.
4. Paste the service account's client ID into **Client ID**.
5. In **OAuth Scopes**, enter `https://www.googleapis.com/auth/admin.directory.user.readonly`.
6. Click **Authorize**.

## Step 3: Connect it in Rig

New to Rig? Watch how to find Connections

Adding a source needs a workspace owner, or a role with the Manage connections permission, on a workspace where you manage your own connections. If the Connectors tab says “Data ingestion for this workspace is managed by Rig”, ask an owner or Rig support to add the source.

1. In Rig, open `Connections`, choose the `Connectors` tab and go to `Sources & actions`.
2. Search for **Google Workspace Directory**, open the card and click `Connect`.
3. **Service account JSON key**: Paste the whole contents of the JSON key file you downloaded.
4. **Admin to act as**: The email address of the admin who holds the **Users** read privilege.
5. **Customer ID (optional)**: Leave it blank to read your own account. Set it only if you need a specific customer ID, which you can find under **Account settings** in the Admin console.
6. Click `Continue`. Rig checks the credentials and lists the streams it can reach, so choose the ones you want and click `Connect`.
7. The source then syncs on its schedule, which is nightly unless you change it. To load data straight away, click `Sync` on its row; `Test` pulls a small sample first if you want to check the connection.

## What Rig pulls in

Google Workspace Directory lands in its own `google_workspace_directory` schema in your warehouse:

- **Users**: one row per Workspace account, with manager, department, title, cost centre, org unit, suspended and archived flags and the account creation time.

Last login time is off by default and Rig only requests it if you tick it. Family relations are never stored, and each sync replaces the table so a deleted account drops out of the directory.

## Good to know

- Workspace stores neither start or leave dates nor a team object, so the org unit and the department text are your team fields.
- Rig asks Google for only the columns you have selected, so phones, addresses and recovery details never leave Google.
- If the connection test fails with an authorisation error, check that the client ID and scope in domain-wide delegation match exactly and that the admin you named really holds the Users read privilege.
- To disconnect Google Workspace Directory, click the bin icon on the source's row under `Sources & actions`. Only whoever connected the source or a workspace owner can do this, and data already synced stays in the warehouse.

## What people use this for

- Keep an accurate people directory
- Find stale and suspended accounts
- Join the directory to cost and usage data

[More ideas for using Google Workspace Directory](https://rig.so/integrations/google-workspace-directory)

## Google Workspace Directory documentation

- [Google Workspace: create access credentials and set up domain-wide delegation](https://developers.google.com/workspace/guides/create-credentials)

Was this guide helpful?

Yes No

---

- [This page as HTML](https://rig.so/guides/connect-google-workspace-directory)
- [Site map for language models](https://rig.so/llms.txt)
- [API and agent documentation](https://rig.so/developers)