Overview
The Google Workspace integration monitors your organization’s user directory, MFA enrollment, security settings, admin activity, and managed devices. LowerPlane uses read-only OAuth access and connects via the Google Admin SDK.Authentication
Google Workspace uses OAuth 2.0. You must sign in with a Super Admin account to authorize LowerPlane.Required Permissions (OAuth Scopes)
What LowerPlane Collects
User Directory
All users with profile data: name, email, department, title, status, creation date, last login, and organizational unit.
MFA / 2-Step Verification
Per-user 2-step verification enrollment status. Whether each user has enrolled in 2SV and what factors they use.
Groups & Roles
Group memberships and admin role assignments for access review campaigns and privileged access monitoring.
Admin Audit Logs
Administrative actions from the Google Admin Console: user creation, suspension, password resets, group changes, and security setting modifications.
Managed Devices
Chrome OS and mobile devices enrolled in Google endpoint management with compliance status.
Domain Settings
Domain-level security configurations including 2SV enforcement policy.
Security Tests
LowerPlane runs automated tests against your Google Workspace organization:Cross-IdP MFA Passthrough
When Google Workspace enforces 2-step verification at the organization level, LowerPlane automatically passes MFA-related tests for downstream services authenticated via Google SSO.Connecting
1
Navigate to Integrations
Go to Settings > Integrations and find Google Workspace under Identity Providers.
2
Click Connect
Click the Connect button. You will be redirected to Google’s OAuth consent screen.
3
Authorize with Super Admin
Sign in with a Google Workspace Super Admin account. Review the requested permissions and click Allow. Standard admin accounts may not have sufficient privileges.
4
Initial Sync
LowerPlane syncs your user directory, groups, security settings, and admin logs. This typically takes 2-5 minutes depending on organization size.
Evidence Artifacts
Data Access
Troubleshooting
User count is lower than expected
User count is lower than expected
LowerPlane syncs users from all organizational units by default. Check if some OUs are suspended or if certain users are in a different Google Workspace instance.
2SV status shows unenrolled but users have MFA
2SV status shows unenrolled but users have MFA
Google’s Admin SDK reports 2SV enrollment status from the directory, not from individual sign-in sessions. If 2SV enforcement was recently enabled, users may not appear as enrolled until they complete the enrollment flow.
Admin logs are empty
Admin logs are empty
Admin audit logs require at least a Google Workspace Business or Enterprise subscription. Google Workspace Essentials may not include audit log API access.