---
title: "Integrate Google Workspace with Red Canary"
slug: "integrate-google-workspace-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-google-workspace-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Google Workspace with Zscaler MDR

Integrating Google Workspace with Zscaler MDR enhances your organization's security posture by providing advanced threat detection and response for your cloud-based collaboration tools. You will gain deeper visibility into user activities, identify suspicious behaviors, and protect against targeted attacks. To integrate Google Workspace with Zscaler MDR, follow the procedure below from beginning to end.

> **Note**: If you don't see Google Workspace as an option, please contact your Zscaler MDR account team who can talk to you about upgrading.

## **Step 1: Google Cloud Console–Create a project**

Create a Google Cloud Console project to start sending google workspace telemetry for ingestion.

1. From your Google Cloud Console dashboard, click **Create Project**. ![1.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381626089751.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
2. Fill in the mandatory fields:
  1. Project Name—The name associated with your project
  2. Organization—The name of your organization
  3. Location—Location of your organization
3. Click **Create**.

## **Step 2: Google Cloud Console–Enable the Administrator software development kit (SDK)**

Enable the Admin SDK to create and manage admin-controlled resources owned by a Google Workspace account.

1. From your Google Cloud Console dashboard, type **Admin SDK API** into the search bar.
2. From the Marketplace section, click **Admin SDK API**. Check the drop down in the top left, next to **Google Cloud** and verify that the current project matches the project created in [Step 1](https://redcanary.document360.io/doc/docs/integrate-google-workspace-with-red-canary#step-1-google-cloud-console%E2%80%93create-a-project:~:text=Create%20a%20Google%20Cloud%20Console%20project%20to%20start%20sending%20google%20workspace%20telemetry%20for%20ingestion.%C2%A0).

![2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381676865943.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
3. Click **Enable**.

## **Step 3: Google Cloud Console–Enable the Alert Center API**

Enable the Alert Center API to create and manage alerts and issues owned by a Google Workspace account.

1. From your Google Cloud Console dashboard, type **Alert Center API** into the search bar.
2. From the Marketplace section, click **Alert Center API**.

![3.2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10388753115927.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
3. Check the drop down in the top left, next to **Google Cloud** and verify that the current project matches the project created in [Step 1](https://redcanary.document360.io/doc/docs/integrate-google-workspace-with-red-canary#step-1-google-cloud-console%E2%80%93create-a-project:~:text=Create%20a%20Google%20Cloud%20Console%20project%20to%20start%20sending%20google%20workspace%20telemetry%20for%20ingestion.%C2%A0).
4. Click **Enable**.

## **Step 4: Google Cloud Console–Create a service account**

Create a service account to enable Zscaler MDR to ingest your data.

1. From your Google Cloud Console dashboard, select the project you created in [Step 1](https://redcanary.document360.io/doc/docs/integrate-google-workspace-with-red-canary#step-1-google-cloud-console%E2%80%93create-a-project:~:text=Create%20a%20Google%20Cloud%20Console%20project%20to%20start%20sending%20google%20workspace%20telemetry%20for%20ingestion.%C2%A0).
2. Click the **Navigation menu** icon.

![3.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381609388439.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
3. Click **IAM & Admin**, and then click **Service Accounts**.

![4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381625949975.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
4. Click **Create Service Account**.
5. Fill in the mandatory fields:
  1. Service account name
  2. Service account ID
6. Click **CREATE AND CONTINUE**.
7. Click **Done**.

## **Step 5: Google Cloud Console–Create a private key**

Create a private key so that sanctioned users can use the service account.

1. From the service account you just created, click the **Actions** icon, and then click **Manage Keys**.

![5.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381625909399.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
2. Click the **Add Key** dropdown.

![6.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381625578007.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
3. Click **Create new key**.

![7.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381625592215.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
4. Select **JSON**, and then click **Create**.
5. Save this .JSON file in a secure location.

## **Step 6: Google Cloud Console–Enable domain-wide delegation for service accounts**

Enable domain wide delegation to allow applications to access user data across your organization's Google Workspace environment.

1. From your Google Cloud Console dashboard, select the project you created in [Step 1](https://redcanary.document360.io/doc/docs/integrate-google-workspace-with-red-canary#step-1-google-cloud-console%E2%80%93create-a-project:~:text=Create%20a%20Google%20Cloud%20Console%20project%20to%20start%20sending%20google%20workspace%20telemetry%20for%20ingestion.%C2%A0).
2. Click the **Navigation menu** icon.

![8.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381625387031.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
3. Click **IAM & Admin**, and then click **Service Accounts**.
4. From the service account you just created, click the **Actions** icon, and then click **Manage Details**.

![9.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381625419799.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
5. Copy and save the **Client ID** (Same as Unique ID). ![10.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381625775639.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
6. Click **View Google Workspace Admin Console**.

## **Step 7: Google Workspace–Grant the Service Account the required API Permissions scope**

Granting the service account proper permissions enables Zscaler MDR to ingest all the necessary telemetry.

1. From your Google Workspace Admin Console, click the **Security** dropdown.

![11.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381693750295.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
2. Click the **Access and data control** dropdown.
3. Click **API Controls**.

![12.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381693736983.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
4. Scroll down, and then click **Manage Domain-Wide Delegation**.

![13.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381693592087.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
5. Click **Add New**.

![14.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381693540247.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
6. For the Client Name field, enter the Client ID from [Step 6.5](https://redcanary.document360.io/docs/integrate-google-workspace-with-red-canary#step-6-google-cloud-console%E2%80%93enable-domainwide-delegation-for-service-accounts:~:text=Copy%20and%20save%20the%20Client%20ID%20(Same%20as%20Unique%20ID).).
7. For the OAuth scopes field, enter:
  1. [https://www.googleapis.com/auth/admin.reports.audit.readonly](https://www.googleapis.com/auth/admin.reports.audit.readonly)
  2. [https://www.googleapis.com/auth/apps.alerts](https://www.googleapis.com/auth/apps.alerts)
  3. [https://www.googleapis.com/auth/admin.reports.usage.readonly](https://www.googleapis.com/auth/admin.reports.usage.readonly)
  4. [https://www.googleapis.com/auth/admin.directory.group.member.readonly](https://www.googleapis.com/auth/admin.directory.group.member.readonly)
  5. [https://www.googleapis.com/auth/admin.directory.group.readonly](https://www.googleapis.com/auth/admin.directory.group.readonly)
8. Click **Authorize**.

## **Step 8: Google Workspace–Create a Google Workspace service account for Zscaler MDR**

The Google service account created in [Step 4](https://redcanary.document360.io/docs/integrate-google-workspace-with-red-canary#step-6-google-cloud-console%E2%80%93enable-domainwide-delegation-for-service-accounts:~:text=Create%20a%20service%20account%20to%20enable%20Red%20Canary%20to%20ingest%20your%20data.) requires a google workspace account to start sending telemetry to Zscaler MDR.

> **Note**: You can re-use an existing Google Workspace user account with Admin Console Reports permissions.

1. From your Google Workspace Admin Console, click the **Directory** dropdown.
2. From the Directory dropdown, click **Users**.
3. Click **Add new user** with the following details:
  - **First Name**: Zscaler MDR
  - **Last Name**: Service
  - **Email Address**: redcanary-service@[companydomain].com

![7.1.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9632863834135.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
4. Fill in the fields to identify the Zscaler MDR service account.
5. Click **Add new user**.

> **Note**: You do not need to copy or use the automatically generated password. To set your own password, click **Preview and send**.
6. Click **Done**.
7. To see your new user account, refresh the Users page.
8. Select the user account you just created.
9. Scroll down to the Admin roles and Privileges section, and then click the **Expand Roles and Privileges** dropdown.

![7.2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9632863837079.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
10. Click **Create Custom Role**.

![7.4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9632863907607.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
11. Click **Create new role**.
12. Enter a name for your new role.
13. Enter a description for your new role.
14. Click **Continue**.
15. From the Privilege Name section, scroll down and then click the **Services** dropdown.
16. Click the **Groups** Dropdown, scroll down and select **Read**. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Screenshot 2025-01-29 at 2.37.31 PM(3).png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
17. Click the **Alert Center** Dropdown, and then select **View Access.**

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Screenshot 2025-01-30 at 12.03.27 PM(2).png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
18. From the Privilege Name section, scroll down and select **Reports**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Screenshot 2025-01-30 at 12.03.43 PM.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
19. Click **Continue**.
20. Click **Create Role**.
21. Click **Assign users**.
22. Enter the name of the new service account you created in [Step 8.4](https://redcanary.document360.io/docs/integrate-google-workspace-with-red-canary#step-6-google-cloud-console%E2%80%93enable-domainwide-delegation-for-service-accounts:~:text=Fill%20in%20the%20fields%20to%20identify%20the%20Red%20Canary%20service%20account.).
23. Click **Assign Role**.

## **Step 9: Zscaler MDR–Integrate Google Workspace with Zscaler MDR**

Connect your Google service account key to Zscaler MDR in order to start receiving Google Workspace alerts in Zscaler MDR.

1. In the Zscaler MDR portal, click **Integrations**.

![image(70)](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(70).png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
2. Click Google Workspace.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/workspace.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
3. Click **Configure**.
4. Enter the service account key from the .JSON file you downloaded from Google Workspace in [Step 5.5](https://redcanary.document360.io/docs/integrate-google-workspace-with-red-canary#step-6-google-cloud-console%E2%80%93enable-domainwide-delegation-for-service-accounts:~:text=Save%20this%20.JSON%20file%20in%20a%20secure%20location.).
5. Enter the email account created in Step 8. **Note: The email address entered must mach the Google Workspace user created in Step 8. This email is not expected to match the email found in the JSON key.**

![16.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9381677113495.png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
6. Optional: Click **Advanced Configuration** to exclude selected Google Workspace identity groups from being counted as monitored identities. Note that excluded groups and identities may still be included in investigations and threats, but will not be included in the MDR Identities count on the License Usage page.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Screenshot 2025-04-02 at 8.53.57 AM(3).png?sv=2026-02-06&spr=https&st=2026-10-30T14%3A06%3A45Z&se=2026-10-30T15%3A06%3A45Z&sr=c&sp=r&sig=d4tYyEa60XcBHqPB6fWLlNBuKbD7BzOhU1fqUEdsCQ0%3D)
7. Click **Save**.

## **Ingest Details**

**Environments covered**

- Google Workspace

**Ingest details**

Zscaler MDR polls two APIs to collect data from Google Workspace:

- [Reports API](https://developers.google.com/admin-sdk/reports/v1/get-start/overview) (Zscaler MDR processes these audit activity sources as telemetry)
  - [User accounts](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/user-accounts) activity
  - [Login](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/login) activity
  - [Admin](https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-event-names) activity
- [Alert Center API](https://developers.google.com/admin-sdk/alertcenter/guides) (Zscaler MDR processes [all retrieved data](https://developers.google.com/admin-sdk/alertcenter/reference/alert-types) as external alerts)
- [Customer Usage Reports API](https://developers.google.com/admin-sdk/reports/v1/appendix/usage/customer/accounts) (Zscaler MDR polls the [Customer Usage Reports API](https://developers.google.com/admin-sdk/reports/v1/appendix/usage/customer/accounts) once daily to retrieve the total number of users for licensing purposes)

The Google Workspace ingestor currently polls the above-mentioned APIs every five minutes. There is a lag between event creation in Google and the time that Zscaler MDR’s ingestor processes the event creations when polling the Reports API. For more information, see [Data retention and lag times](https://support.google.com/a/answer/7061566?hl=en). Google takes a long time to make event kinds available via the API. However, this lag should not apply to the Google Workspace Alert Center API.

## **Required permissions and actions for the Google Workspace integration**

**APIs and Permissions**

This integration article specifies enabling only the necessary APIs, including Admin SDK and Alert Center, and assigning specific read-only permissions. Only the required APIs and scopes are enabled and granted.

**Create a Service Account**

The creation and configuration of service accounts are focused on providing specific roles and permissions needed for data ingestion without granting excessive access. The steps include creating a custom role with view access and specific privileges for reports and alerts and ensuring the service account has only the necessary permissions.

**Google Workspace Service Admin Account email**

The Google Workspace Service Admin Account email, created in the Google Workspace Admin console, is used for viewing reports and viewing the alert center. This account does not give Zscaler MDR admin access to your Google Workspace environment. It is tied to the private key that was created for the service account that was created in the Google Cloud Console.

**Domain-Wide Delegation**

The domain-wide delegation is explicitly scoped to specific API permissions necessary for the telemetry data, including audit read-only, app alerts, and usage read-only.

**Create a Private Key**

The purpose of creating the private key in the Google Cloud Console setup process is to enable secure authentication and authorization for the service account.

- **Authentication**: The private key is used to authenticate the service account to Google Cloud services. A service account must prove its identity when it attempts to access Google APIs. The private key is part of a pair (public/private) that securely identifies the service account.
- **Authorization**: The private key and the service account grant permission to access specific Google Cloud and Google Workspace APIs. It ensures that only authorized entities (in this case, the service account with the correct private key) can access the resources and perform actions.
- **Secure Communication**: The private key facilitates secure communication between the service account and Google APIs. It ensures that the data sent between the client (service account) and server (Google APIs) are encrypted and cannot be tampered with.

The private key is crucial for allowing the service account created in the Google Workspace console to access the necessary APIs for telemetry ingestion. Here’s how it works in the context of the setup process described in the integration document:

- **Service Account Creation**: A service account is created with specific roles and permissions for telemetry ingestion.
- **Private Key Generation**: A private key is generated for this service account, which will be used to authenticate and authorize the service account when accessing Google Workspace APIs.
- **Integration with Zscaler MDR**: The private key (in JSON format) is saved and used to configure the Managed Service Provider (Zscaler MDR) to ensure secure and authorized access to the telemetry data.
- **API Access**: The service account uses the private key to access the Admin SDK API and Alert Center API to retrieve and send telemetry data from Google Workspace to the Zscaler MDR.

In summary, the private key is an essential component that allows the service account to securely and effectively access the necessary APIs for telemetry ingestion, ensuring that the data is handled securely.