Google Workspace Provisioning integration

Bob's provisioning integration with Google Workspace allows you to automatically create users for new hires, update changes to employees and deactivate users when employees leave. 

Integration Details

Integration type

One-way via API

Direction of data flow

Bob to Google Workspace

Sync trigger

An event

Sync frequency

  • Employee created
  • Employee joined
  • Employee updated

Note: By default, users will begin synchronization on their start date.

Support information

support@hibob.com

Default data mapping

Note: After connecting the integration you can customize the data mapping in the Provisioning settings. To learn more, see Map data for provisioning integrations.

Bob Field

Google Workspace Field

First Name

First Name

Last Name

Last Name

Email

Email

Mobile Phone

Phone (mobile)

Work Phone

Phone (work)

Department

Department

Job Title

Job Title

Reports to

Manager`s email

Employee ID

Employee ID

Employment Type

Type of employee

Before you begin

Ahead of setting up the integration you'll need to:

How to set up Google Workspace provisioning integration in Bob

Step 1: In Google Workspace

Create a service account (without a role)

  1. From the Google API Console, select Credentials.

  2. Click + Create credentials > Service Account.617ba89faa0d0

  3. Enter the Service account name, then click Create and Continue. mceclip0.png

  4. In Grant this service access to project section, leave the ROLE empty, then click Continue.617ba8a117c08

  5. In the Grant users access section, leave the settings blank, then click Done.617ba8a1acbbe

Step 2: In Google Workspace

Generate a key for the service account

  1. In the Credentials page, click the service user that was created.

  2. In the Keys section, click Add Key > Create new key. mceclip1.png

  3. Select JSON, then click Create. mceclip2.png

Step 3: In Google Workspace

Enable Google Workspace Admin SDK API

  1. From the Google API Console Dashboard, click + Enable APIs and Services. mceclip3.png

  2. Find and enable the Admin SDK.617ba8a585bff

Step 3: In Google Workspace

Authorize the service account to use the required Google APIs

  1. From the Google Admin Console, select Security > API Controls.

  2. Click Manage Domain Wide Delegation.617ba8a6575ab

  3. Click Add New.617ba8a73de88

  4. Obtain the client_id value from the service account private key you downloaded earlier. e.g. In the below image, the client_id value is 111044703125069446382. 617ba8a7ed59f

  5. In Client ID, paste the client_id value.
  6. In the 0auth scopes field, enter the following value: https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/admin.directory.userschema.readonly
  7. Click Authorize.617ba8a73de88

The service account is now authorized to use 2 scopes of the Admin SDK API:

  • View and manage the provisioning of users on your domain - needed in order to synchronize employees from Bob to the Google user directory.

  • View user schemas on your domain - needed in order to retrieve the custom fields defined for the Google user profile.

Step 5: In Bob

Once you have completed the Google Workspace setup steps described above, you can start configuring the integration in Bob.

  1. From the left menu, select Settings > Integrations.
  2. Select Provisioning
  3. In the Google Workspace tile, click Connect
  4. Enter a Google Workspace administrator email address. Note: This must be a Super Admin account or an Admin account with complete Admin API privileges.
  5. Upload your Google service account private key file (downloaded in step 3 above).
  6. Enter a Default password for newly created Google Workspace accounts.
  7. Check the Change password on first login box if you'd like a newly created account user to be prompted to change the default password upon their first visit.
  8. Click Apply.

FAQs

When is a user created in Google Workspace?
Based on your configuration, Bob can create an Google Workspace user once the user's profile has been created in Bob, or based on an employee's status in Bob.

How do I edit the provisioning settings?
To learn more about how too change the default settings and set how the users will be created, see the provisioning settings.

Will users created before the Google Workspace integration was created be synchronized to Google Workspace?
Yes, Bob users created before the Google Workspace integration will be synchronized in Google Workspace once one of the mapped properties is updated for an employee in Bob. Users that have not yet been created in Google Workspace will be created while existing users will be updated.

Is it possible to deactivate all newly created users in Google Workspace?
Yes, Bob's support team can configure the Google Workspace integration so that all newly created users will be deactivated. The reverse is also possible: the integration can be configured so that all newly created users will be activated.