Safeguard Docs
Compliance ConnectorsSetup by categoryIdentity & SSO

Google Cloud Identity

Connect Google Cloud Identity to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Connect Google Cloud Identity to collect identity & sso evidence automatically.

CategoryIdentity & SSO
Connect withOAuth, API token
What a connection producesAutomated evidence collection

Connect with OAuth

Before you start, an administrator of Google Cloud Identity must allow third-party apps:

  • If your Admin console restricts unconfigured apps: go to Menu › Security › Access and data control › API controls and click Manage App Access.
  • Click Configure new app, enter Safeguard's app name or OAuth client ID and click Search, then select it.
  • Choose the organizational units it applies to (or leave the default for all users), select Trusted, and click Continue, then Finish.
  • By default Allow users to access any third-party apps is set, so no step is needed unless you changed the Unconfigured third-party apps setting.
  1. On Compliance › Connectors, open Google Cloud Identity, click Connect and choose OAuth.
  2. Sign in to Google Cloud Identity and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for https://www.googleapis.com/auth/cloud-identity.groups.readonly, https://www.googleapis.com/auth/cloud-identity.devices.readonly.
  3. You return to Safeguard, and the card shows Verified once the first check succeeds.

Connect with an API token

  1. In Google Cloud Identity:

    1. In the Google Cloud console, go to Menu › IAM & Admin › Service Accounts and select your project.
    2. Click Create service account, enter a name, and click Create and continue; skip optional roles and click Done.
    3. Click the service account's email address, select the Keys tab, and click Add key › Create new key.
    4. Choose JSON and click Create. The key file downloads to your machine; it is the only copy and cannot be downloaded again.
    5. In the service account's details, click Show advanced settings and note the Client ID under Domain-wide delegation.
    6. In the Google Admin console, go to Menu › Security › Access and data control › API controls › Manage Domain Wide Delegation.
    7. Click Add new, paste the service account's Client ID, enter the read-only scopes comma-delimited: https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly,https://www.googleapis.com/auth/cloud-identity.groups.readonly,https://www.googleapis.com/auth/cloud-identity.devices.readonly, and click Authorize. Changes usually apply quickly but can take up to 24 hours.

    Where to find the other values:

    • Admin email to impersonate: The email address of a Google Workspace administrator in your domain who can read users, domains and devices.

    Google Cloud Identity shows the secret only once, so copy it before you leave the page.

    Source: developers.google.com, knowledge.workspace.google.com, checked 2026-10-07.

  2. On Compliance › Connectors, open Google Cloud Identity, click Connect, choose API token and fill in:

    FieldWhat to enter
    Service account key (JSON)Optional. Domain-wide delegation service account with Admin SDK Directory read-only scopes. Stored encrypted and never shown again.
    Admin email to impersonateOptional.
    OAuth access token (optional)Alternative: paste a short-lived OAuth token with Admin SDK Directory scopes. Stored encrypted and never shown again.

  3. Click Connect with token.

Frameworks

Safeguard's automated tests read Google Cloud Identity and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

FrameworkEvidenceControlsTests
SOC2Automated testsC1.1, CC6.1, CC6.2, CC6.3, CC6.5, CC6.6, CC6.7, CC6.8, CC7.1, CC7.2, CC9.228
ISO/IEC 27001Automated testsA.5.9, A.5.11, A.5.14, A.5.16, A.5.17, A.5.18, A.5.19, A.6.5, A.8.1, A.8.2, A.8.3, A.8.5, A.8.7, A.8.8, A.8.9, A.8.12, A.8.16, A.8.20, A.8.2428
HIPAA Security RuleAutomated tests164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(b)(1), 164.310(d)(1), 164.312(a)(1), 164.312(d), 164.312(e)(1)24
PCI DSSAutomated tests1.5.1, 3.5.1, 5.2.1, 5.4.1, 6.3.3, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.1, 8.4.2, 10.4.1, 12.5.122
NIST CSF 2.0Automated testsDE.CM-03, DE.CM-09, GV.SC-04, GV.SC-05, ID.AM-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.IR-01, PR.PS-0224

These tests are switched on per workspace by the Safeguard team.

Google SSO, Google Workspace connect to the same provider as Google Cloud Identity, and these tests run for a connection made through any of them.

FusionAuth

Connect FusionAuth to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

Google SSO

Connect Google SSO to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.

On this page

Connect with OAuthConnect with an API tokenFrameworksRelated