Set up Workspace governance

This guide connects one organization to Google Workspace, establishes its governed topology, applies the approved setup, and leaves scheduled audits enabled.

Before you begin

You need:

• membership in the intended Infra One organization;
• the workspace_governance rollout flag on that organization;
• an explicit Workspace governance Admin grant for the connection steps;
• a Google Workspace super-admin identity in the domain you are connecting;
• permission to authorize the displayed service-account client ID and exact OAuth scopes in Google Admin;
• an approved change window for importing, applying, and auditing the intended drives, folders, groups, and permissions.

An Infra One organization-admin role alone is not enough, and a platform administrator gets no access bypass. The explicit Workspace governance grant is organization-scoped.

Do not paste a service-account JSON key, OAuth secret, Slack configuration token, or customer data into documentation, a ticket, or an unapproved channel.

Open Workspace governance

1. Open https://workspace-governance.infra.one/your-organization-slug.
2. Confirm that the page title is Workspace governance and that the subtitle says Manage Google Workspace drives, folders, groups, and access in one place.
3. If the app is absent or returns not found, confirm the rollout flag first. If it opens but denies access, ask a current grant administrator to assign the appropriate Workspace governance grant.
4. Open Settings.

Authorize the service account

The Google Workspace Marketplace app is currently unpublished. Use Manual setup (if the marketplace app cannot be installed) and the domain-wide delegation values displayed by Infra One.

1. In Google Workspace connection, expand Manual setup (if the marketplace app cannot be installed).
2. Copy the displayed Client ID and the complete comma-separated OAuth scopes list.
3. In Google Admin, go to Security > Access and data control > API controls > Domain-wide delegation.
4. Add a new entry for the copied client ID and paste the full scope list exactly as displayed.
5. Save the entry. Do not substitute the general Infra One cloud service account; Workspace governance uses a separate delegated identity.

The service account does not need to be a member of the workspace. The subject entered in the next step must be a super admin in the connected Google Workspace.

Connect Google Workspace

1. Return to Settings.
2. Under Workspace admin email, enter the super-admin email that the service account should act as.
3. Select Connect Google Workspace.
4. After the connection appears, select Test connection.
5. Confirm Connection test passed. before importing or applying anything.

The connection test covers the required Drive, shared-drive administrator, Google Groups administrator, and user-directory surfaces. A token can be minted while one of those APIs or grants is still unavailable, so treat the successful test as a separate prerequisite.

Import or define the topology

1. In Settings, select Import from Google to read the live drives, folders, and groups into the local setup. Review the confirmation before proceeding.
2. Alternatively, open Drives and Groups and define only the resources that should become governed.
3. On Drives, review each drive’s hardening controls and decide whether it is an Airlock drive.
4. On Groups, classify each group as Role, Access, External, or Distribution. Use the configured prefixes for access and external groups.
5. Add group-based access grants at the drive root or a managed top-level folder. External groups require an airlock drive that permits users outside the domain.
6. Return to Overview and confirm the banner You have changes not yet applied to Google Workspace.

Importing is a read from Google, but it writes the observed topology into Infra One. Review the imported records before applying them back to Google.

Apply and audit the setup

1. On Overview, select Apply to Google.
2. Read the confirmation. Applying can create or adopt drives, folders, groups, and permissions.
3. Confirm the action and wait for Applying… to finish.
4. Select Audit now and wait for Auditing… to finish.
5. Review Audit health and Unmanaged resources. Resolve Drifted, Missing, or Error results rather than treating the job completion alone as success.
6. In Settings, enable Scheduled audits and select the approved interval: 6, 12, 24, or 48 hours.

Success check

The Overview shows the connected Google domain, no unexpected pending-change banner, and an Audit health result for the governed resources. The latest results are either In sync or have explicitly reviewed findings, and Scheduled audits shows Enabled with the intended interval.

Troubleshooting

• The service account is not configured for this environment. Stop and ask the environment owner to configure the dedicated Workspace governance service account. Do not substitute another credential.
• The marketplace app is not published yet. This is the expected current state. Complete the manual domain-wide delegation steps with the displayed client ID and full scope list.
• The service account could not access Google Workspace as this admin. Confirm that domain-wide delegation was saved with every displayed core scope and that the email belongs to a super admin in that workspace.
• Connection test failed. Recheck the Drive, shared-drive administrator, Groups administrator, and directory permissions. Do not apply topology until Connection test passed. appears.
• Import or Apply appears stuck. Wait for the job-completion message. If it reports a problem, preserve the visible error, the organization, and the time, then retry only after confirming the provider is available.
• Audit health shows Error. Treat the provider read as unavailable, not clean. Fix the connection or API access and run the audit again.

Related pages

• Workspace governance overview
• Manage topology, templates, Slack, and mailboxes
• Workspace governance permissions and states
• Troubleshoot Workspace governance