Google Workspace Integration

Send Google Workspace Admin Activity Reports to Realm

This guide walks you through connecting Google Workspace Admin Activity Reports to Realm. The integration uses a polling-based approach — Realm Cloud periodically queries the Google Admin SDK Reports API to retrieve admin activity events, then forwards them through your data pipeline to your configured destination.

Prerequisites

• A Google Workspace account with super administrator access
• Access to the Google Cloud Console
• Access to the Realm Security console

Create a Google Cloud Project

If you do not already have a Google Cloud project to host the service account, create one first.
Creating a GCP Service Account

1. Go to the Google Cloud Console.
2. Click the project selector in the top navigation bar, then click New Project.
3. Enter a project name (e.g., Realm Integration) and click Create.

Enable the Admin SDK Reports API

1. In the Google Cloud Console, navigate to APIs & Services > Library.
2. Search for Admin SDK API.
3. Click the result, then click Enable.

Create a Service Account

1. Navigate to IAM & Admin > Service Accounts.
2. Click Create Service Account.
3. Enter a name (e.g., realm-reports-reader) and an optional description, then click Create and Continue.
4. Skip the optional IAM role and user access steps — click Continue, then Done.
5. Click the newly created service account to open its details.
6. Navigate to the Keys tab and click Add Key > Create New Key.
7. Select JSON and click Create. The key file downloads automatically.

Important: Store the downloaded JSON key file securely. You will need its contents when configuring the integration in Realm.

Grant Domain-Wide Delegation

Granting Domain-Wide Delegation
The service account must be authorized to access Reports API data on behalf of a Google Workspace admin user. This is a two-part process: first retrieve the Client ID from Google Cloud Console, then authorize the service account in the Google Workspace Admin Console.

Retrieve the Service Account Client ID

1. In the Google Cloud Console, navigate to IAM & Admin > Service Accounts.
2. Click the service account you created.
3. Expand Advanced Settings and copy the Client ID.

Note: You will need this Client ID in the next step.

Authorize the Service Account in Google Workspace

1. Log in to the Google Workspace Admin Console as a super administrator.
2. Navigate to Security > Access and data control > API Controls.
3. Under Domain wide delegation, click Manage Domain Wide Delegation.
4. Click Add new and enter the following:

   Client ID: <your service account Client ID>
   OAuth Scopes: https://www.googleapis.com/auth/admin.reports.audit.readonly

5. Click Authorize.

Note: The admin.reports.audit.readonly scope grants read-only access to the Admin Activity Report and is the minimum permission required for this integration. For more details, refer to the Admin SDK Reports API documentation.

Identify the Delegated Admin User

The service account impersonates a Google Workspace user with sufficient privileges to query the Reports API. This must be a super administrator account.

1. Note the primary email address of a super administrator in your Google Workspace domain (e.g., admin@yourdomain.com). You will enter this in Realm as the delegated user.

Create a Source and Input Feed

1. In Realm, go to Sources > Add Source.

2. Enter a name for your source and select a the Google Workspace product type.

3. Add a new Input Feed to the source. Select Google Workspace as the input feed type.

4. You will need to input the follow before saving:

   Google Service Account Key: The JSON contents of the GCP service account key file you generated in the GCP console.
   Subject(Admin Email): the admin email the service account key has permissions to impersonate.
   Applications: Select from the list of google workspace applications you want logs to be queried for.