Directory SyncEnterprise

Google Workspace Directory Sync

Read Google Workspace users, groups and active status into Cremit when an authorized user runs a directory sync.

Connect Google Workspace Directory View Setup Guide

Key Features

OAuth connection with read-only Directory API user and group scopes
Manual pull of users, groups and direct active user memberships
Suspended state recorded on directory user mappings
Last-sync status and time to check data freshness

Requirements

1A Google Workspace account authorized to read the intended directory data
2Permission to grant the requested Directory API OAuth scopes
3Permission to create and update a directory provider in Cremit

Step-by-step setup guide

Review the steps needed to configure this integration.

Is this Google Workspace SCIM provisioning?

No. This connection uses Google OAuth and the Admin SDK Directory API to read users, groups and group members. It is stored in Cremit as an API-pull directory provider. The current Google Workspace setup does not supply a SCIM endpoint or bearer token to paste into Google Admin, and the sync is started from Cremit’s provider page. Okta uses a separate SCIM-push path.

The pull records user email, display name and whether Google marks the account suspended. It also records groups and direct active user memberships. This directory context can help an investigator see whether a finding author is marked inactive. It does not prove who currently owns a credential. A suspended Google account is reflected only after a successful pull; this path does not instantly revoke Cremit sessions or API tokens when Google suspends the account.

Connect and run a sync

In Cremit Platform, open the directory integration settings and add a provider named for the Google Workspace connection. Choose Google Workspace and complete the OAuth popup. Review the requested read-only scopes for directory users and groups. The account must have access to the intended Workspace directory data. There is no SCIM provisioning switch or OU-scoped push setup in this flow.

Open the created provider and use Sync to pull the current users and groups. Check the last-sync time and result before relying on inactive status or group context. The current product route handles a user-initiated pull; do not assume a configured interval or automatic real-time refresh from the presence of stored sync settings.

Verify the result and handle offboarding

Choose one known active account and one suspended test account, run a sync and compare their directory mapping states in Cremit. Check a known group and its direct active user memberships. If the result is stale or failed, fix the Google authorization or data-access error and rerun the pull.

For offboarding, confirm Cremit membership and sessions through the organization’s access controls. Rotate or revoke any exposed credential at its issuer after checking dependencies. A directory inactive flag alone does not disable the credential.