SSO discovery - Google Workspace
Connect your Google Workspace email to discover the systems your employees use, including unmanaged tools and dormant accounts.
Email discovery finds the systems your employees use by reading the metadata of emails they receive from companies, such as sign-up confirmations and service notifications. It never reads email content or attachments. Connecting Google Workspace gives you the widest discovery coverage, including unmanaged tools and dormant accounts left by former employees.
Before you start
You'll need Google Workspace super admin access to set up domain-wide delegation.
Step 1: Authorize MineOS in Google Workspace
-
Login to your Google Workspace Admin dashboard at: https://admin.google.com/
-
Click Security -> Access and data control -> API Controls
-
Under App access control click "Manage third-party app access"
-
Click "Add app" -> "OAuth App Name Or Client ID"
-
-
Paste the following value and click Search:
685949372679-567mh3mbdi96lnleg9qllipef6p185ft.apps.googleusercontent.com
-
Select "MineOS SSO Discovery".
-
Choose the OAuth Client ID and click Select.
-
Select to which organization units you want to enable the discovery for and click Continue. Note: We recommend enabling it to the entire organization to get the highest coverage.
-
Select Trusted and click continue.
-
Lastly, Review the settings and click Finish.
For more information see Google's article: Control which third-party & internal apps access Google Workspace data.
Step 2: Connect in MineOS
- Login to your MineOS account.
- In the left navigation, under Data mapping, select Radar.
- Click Radar Setup.
- Under Single Sign-On, select Google.
- Click Sign in with Google and complete the authorization flow.
- Once completing the steps you should get a message saying the connection was successful and discovery has started.
Discovery starts automatically.
Permissions
| Scope | Why MineOS needs it |
|---|---|
admin.directory.user.readonly | Read your employee directory, to show which employees use each system |
admin.directory.group.readonly | Read groups, to show departments |
gmail.readonly | Read the metadata of emails employees receive from companies, such as sender, date and subject |
All permissions are read-only.
What happens next
Discovered systems appear in Radar as they're found, and discovery continues automatically as employees start using new tools. See Reviewing findings.
Related articles
- Discover your data sources with Radar: all discovery methods and the security FAQ
- Employees discovery: see who uses each system
Updated about 1 hour ago