Google Workspace
Discover domain AI deployments and per-user OAuth grants to AI apps in Google Workspace.
Airia connects to your Google Workspace domain to power Shadow AI visibility: it enumerates users, discovers domain-level AI deployments (Gemini Enterprise, Marketplace AI apps, NotebookLM at organization scope), and lists the third-party OAuth apps each user has granted access to, with AI apps auto-classified. An admin can revoke an OAuth grant directly from the Airia inventory.
Authentication model
A Google Cloud service account with domain-wide delegation. Airia authenticates as the service account and impersonates a Workspace admin user you designate, restricted to the OAuth scopes you delegate. One connection covers one Workspace domain.
Required OAuth scopes (domain-wide delegation)
Grant scopes based on which capabilities you want:
| Capability | Scopes to delegate |
|---|---|
| Core discovery (users, groups, domain AI deployments) | https://www.googleapis.com/auth/admin.directory.user.readonly · https://www.googleapis.com/auth/admin.directory.group.readonly · https://www.googleapis.com/auth/admin.directory.domain.readonly |
| OAuth token visibility and revocation (see which apps users granted, revoke on admin action) | add https://www.googleapis.com/auth/admin.directory.user.security |
| Connected App Discovery scan (full OAuth app enumeration with AI classification) | add https://www.googleapis.com/auth/admin.reports.audit.readonly · https://www.googleapis.com/auth/admin.directory.device.mobile.readonly |
| Optional | https://www.googleapis.com/auth/cloud-identity.readonly |
Delegating the full set up front avoids a second admin round-trip. If the Connected App
Discovery scan fails with an unauthorized_client error, the missing-scope set above is the
cause: edit the delegation entry, add the missing scopes, authorize, and re-run the scan.
Required APIs on the GCP project
Enable on the project hosting the service account: Admin SDK API, Cloud Identity API, and People API (APIs & Services → Library).
Customer-side setup steps
Plan for roughly 30 to 45 minutes, all in the browser.
- In the Google Cloud Console, choose or create a GCP project to host the service account.
- Enable the APIs listed above on that project.
- IAM & Admin → Service Accounts → Create service account. Name it something like
airia-workspace-discovery. Skip the optional role grants. - Open the new service account → Keys → Add key → Create new key → JSON. Download the
JSON file. (If key creation is blocked by your organization's
iam.disableServiceAccountKeyCreationpolicy, an Org Policy Admin needs to allow it for this project.) - From the service account's details, copy its numeric Client ID (also shown as
Unique ID; it is the
client_idvalue inside the downloaded JSON). - In the Google Workspace admin console (admin.google.com), go to Security → Access and data control → API controls → Manage Domain Wide Delegation.
- Add new delegation: paste the service account's Client ID, and in the OAuth scopes field paste the scopes you chose from the table above, comma-separated. Authorize.
- Pick the Workspace admin user Airia should impersonate. API calls are attributed to this user in your audit logs.
- In Airia, go to Discover → Connections → Google Workspace and create a new connection with the domain, the admin email from step 8, and the full JSON key from step 4.
Form fields the Airia UI asks for
| Field | Required | Notes |
|---|---|---|
| Domain | Yes | Your Workspace primary domain (for example acme.com) |
| Admin email | Yes | The admin user Airia impersonates |
| Service account key | Yes | The full JSON key, pasted as-is. Stored encrypted, masked on edit |
What the connector discovers (and does not)
- Domain-level AI deployments: Gemini Enterprise, Marketplace AI apps, NotebookLM at organization scope.
- Per-user OAuth grants to third-party apps, with each app auto-classified as an AI service or not (with a confidence score and detection reasons). This surfaces users who have given AI services access to corporate data even when those sessions never touched your network.
- It does not enumerate personal Gemini Gems, even when shared within the organization (the Admin SDK cannot see them).
- A domain without any domain-level AI deployments can legitimately show zero discovered agents while the connection remains healthy.
Revocation
Revoking an app's OAuth grant is an explicit admin action taken from the discovered-app record in Airia; the app loses access immediately. Airia never auto-revokes.
Multiple environments
Multiple Google Workspace connections per tenant are supported: one per Workspace domain, each with its own service account delegation and impersonated admin.