---
url: https://docs.realmsec.info/integration/google_workspace.md
---

# Google Workspace Integration

### Send Google Workspace Admin Activity Reports to Realm

This guide walks you through connecting [Google Workspace](https://workspace.google.com/) Admin Activity Reports to Realm. The integration uses a polling-based approach — Realm Cloud periodically queries the Google Admin SDK Reports API to retrieve admin activity events, then forwards them through your data pipeline to your configured destination.

## Prerequisites

* A Google Workspace account with **super administrator** access
* Access to the Google Cloud Console
* Access to the Realm Security console

## Create a Google Cloud Project

If you do not already have a Google Cloud project to host the service account, create one first.\
[Creating a GCP Service Account](https://docs.cloud.google.com/iam/docs/service-accounts-create)

1. Go to the [Google Cloud Console](https://console.cloud.google.com/).
2. Click the project selector in the top navigation bar, then click **New Project**.
3. Enter a project name (e.g., `Realm Integration`) and click **Create**.

## Enable the Admin SDK Reports API

1. In the Google Cloud Console, navigate to **APIs & Services > Library**.
2. Search for **Admin SDK API**.
3. Click the result, then click **Enable**.

## Create a Service Account

1. Navigate to **IAM & Admin > Service Accounts**.
2. Click **Create Service Account**.
3. Enter a name (e.g., `realm-reports-reader`) and an optional description, then click **Create and Continue**.
4. Skip the optional IAM role and user access steps — click **Continue**, then **Done**.
5. Click the newly created service account to open its details.
6. Navigate to the **Keys** tab and click **Add Key > Create New Key**.
7. Select **JSON** and click **Create**. The key file downloads automatically.

> **Important:** Store the downloaded JSON key file securely. You will need its contents when configuring the integration in Realm.

## Grant Domain-Wide Delegation

[Granting Domain-Wide Delegation](https://support.google.com/a/answer/162106)\
The service account must be authorized to access Reports API data on behalf of a Google Workspace admin user. This is a two-part process: first retrieve the Client ID from Google Cloud Console, then authorize the service account in the Google Workspace Admin Console.

### Retrieve the Service Account Client ID

1. In the Google Cloud Console, navigate to **IAM & Admin > Service Accounts**.
2. Click the service account you created.
3. Expand **Advanced Settings** and copy the **Client ID**.

> **Note:** You will need this Client ID in the next step.

### Authorize the Service Account in Google Workspace

1. Log in to the [Google Workspace Admin Console](https://admin.google.com/) as a super administrator.
2. Navigate to **Security > Access and data control > API Controls**.
3. Under **Domain wide delegation**, click **Manage Domain Wide Delegation**.
4. Click **Add new** and enter the following:
   > **Client ID:** `<your service account Client ID>`\
   > **OAuth Scopes:** `https://www.googleapis.com/auth/admin.reports.audit.readonly`
5. Click **Authorize**.

> **Note:** The `admin.reports.audit.readonly` scope grants read-only access to the Admin Activity Report and is the minimum permission required for this integration. For more details, refer to the [Admin SDK Reports API documentation](https://developers.google.com/admin-sdk/reports/v1/guides/delegation).

## Identify the Delegated Admin User

The service account impersonates a Google Workspace user with sufficient privileges to query the Reports API. This must be a super administrator account.

1. Note the **primary email address** of a super administrator in your Google Workspace domain (e.g., `admin@yourdomain.com`). You will enter this in Realm as the delegated user.

## Create a Source and Input Feed

1. In Realm, go to **Sources > Add Source**.

![Realm Sources page](../images/sources-page.jpg)

2. Enter a name for your source and select a the Google Workspace product type.
3. Add a new **Input Feed** to the source. Select **Google Workspace** as the input feed type.
4. You will need to input the follow before saving:

   > **Google Service Account Key:** The JSON contents of the GCP service account key file you generated in the GCP console.\
   > **Subject(Admin Email):** the admin email the service account key has permissions to impersonate.\
   > **Applications:** Select from the list of google workspace applications you want logs to be queried for.