Google Workspace Audit connector setup

Polls Google Workspace audit activity from the Admin SDK Reports API (activities.list) for multiple Workspace applications in one connector.

What you need first

Requirement	Details
Google Workspace	Super administrator access to your domain
Google Cloud project	Project with Admin SDK API enabled
Service account	With domain-wide delegation to a super admin user
Audit logging	Workspace audit logging enabled for the apps you plan to collect

---

1. Create a service account and enable delegation

1. Open the Google Cloud Console and select or create a project.

2. Go to APIs & Services → Library, search for Admin SDK API, and Enable it.

3. Go to APIs & Services → Credentials → Create credentials → Service account.

4. Name the account (e.g. perpetual-workspace-audit) and finish creation.

   • Google Cloud may prompt for optional Permissions (project IAM roles) and Principals with access. Skip both — this connector does not need GCP project roles. Access comes from domain-wide delegation in Google Admin (below), not from IAM on the Cloud project.

5. Open the service account → Keys → Add key → Create new key → JSON. Store the key securely.

6. From the JSON key file, note:

   • client_id (numeric) — used for domain-wide delegation in Google Admin (next section)
   • client_email and private_key — used when configuring Perpetual

   You do not need to open the service account details page for the Client ID; it is already in the JSON as client_id.

Domain-wide delegation

1. In Google Admin console, go to Security → Access and data control → API controls.

2. Under Domain wide delegation, click Manage Domain Wide Delegation → Add new.

3. Enter the service account Client ID (client_id from the JSON key).

4. In OAuth scopes, enter:

   https://www.googleapis.com/auth/admin.reports.audit.readonly

5. Click Authorize.

Choose a Workspace admin email to impersonate (e.g. [email protected]). You will enter this as Delegated admin email when creating the connector in step 3.

---

2. Perpetual credential

1. Log in to Perpetual. Open Settings from the user/org control at the bottom left of the sidebar (click your name → Settings), then go to Credentials → New Credential.
2. Choose Text.
3. Fill in:

Field	Value
Name	Unique identifier using letters, digits, and underscores only (e.g. google_workspace).
Allowed URL patterns	*.googleapis.com, *.google.com
Value	Service account private key PEM from the JSON key (private_key field)

4. Save the credential.

Paste the full PEM block, including -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----. If the key contains escaped \n sequences (as exported in JSON), paste it as-is — the connector normalizes them.

---

3. Create the Google Workspace Audit connector

1. Go to Datasets → Connectors → Create Connector.
2. Select Google Workspace Audit.
3. Connector name: unique identifier (letters, numbers, underscores).
4. Configure:
   • Service account private key: select the Text credential from step 2.
   • Service account email: client_email from the same JSON key file (e.g. [email protected]).
   • Delegated admin email: Workspace admin to impersonate via domain-wide delegation (e.g. [email protected]).
   • Poll interval (minutes): default 5.
   • Enable the Workspace applications you want to monitor (at least one required):

Setting	API applicationName	Notes
Admin	admin	Admin console activity
Calendar	calendar	Calendar audit events
Drive	drive	Drive file activity
Login	login	Sign-in events
Token	token	OAuth token grants
Groups	groups	Google Groups changes
Mobile	mobile	Mobile device events
Rules	rules	DLP rules activity (sensitive)
Keep	keep	Google Keep activity
Meet	meet	Google Meet activity
Enterprise Groups	groups_enterprise	Enterprise Groups
Data Studio	data_studio	Looker Studio activity
SAML	saml	SAML activity
Chat	chat	Google Chat activity (sensitive)

5. Optionally check Deploy, then save.

First run backfills roughly the last 24 hours per enabled application. The Reports API retains audit data for up to 180 days.

---

Operational notes

• Sensitive apps: rules and chat streams may include sensitive content metadata; enable only if your retention policy allows it.
• Propagation: Domain-wide delegation can take up to 24 hours to apply across all users.
• Multiple domains: Use a separate service account (or delegated setup) and connector per Google Workspace customer domain.

---

Reference

• Reports API overview
• Reports API scopes
• Domain-wide delegation