> For the complete documentation index, see [llms.txt](https://docs.siit.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.siit.io/guides/integrations/integrations-iam/how-do-i-set-up-google-workspace-actions.md).

# Connect Google Workspace

Connect Google Admin to Siit, review default and optional scopes, and enable Google Workspace actions such as group changes, password reset, suspend user and clear sessions

### Prerequisites

* A Google Workspace account with admin access to authorize the connection.
* Siit admin access to configure integrations.

Available actions

* Add Users to groups
* Remove Users from groups
* Force password change
* Suspend / unsuspend user
* Clear user sessions
* Open Google profile

### Step 1 — Connect Google Admin

1. Go to **Settings → Integration library**.
2. Find **Google Admin** and click **Connect**.
3. Sign in with your Google Workspace admin account when prompted.

Siit opens a configuration modal with three sections

<figure><img src="https://2274035325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlWFhpq2ia6gdHet0opKx%2Fuploads%2Fgit-blob-6b67b11089f77342c73e4435944fe714c849daae%2FCleanShot-2026-02-11-at-17-14-47-png.png?alt=media" alt="Google integration view on Siit"><figcaption></figcaption></figure>

### Step 2 — Review default scopes

Siit requests a set of read-only scopes by default. These are required for directory sync and cannot be removed:

* `admin.directory.domain.readonly`
* `admin.directory.user.alias.readonly`
* `admin.directory.user.readonly`
* `admin.directory.user.security`
* `admin.reports.audit.readonly`
* `userinfo.email` · `openid`
* `admin.directory.group.readonly`

These scopes let Siit read your directory (users, groups, domains) and sync employee profiles. They do not grant write access.

### Step 3 — Add the group management scope

To enable Google Workspace Actions (add/remove users from groups), you need to add one additional scope:

> `https://www.googleapis.com/auth/admin.directory.group.member`

In the **Additional scopes** dropdown, select `admin.directory.group.member` and confirm.

Without this scope, Siit can read your groups but cannot modify memberships. Add it only if you plan to use group actions from requests, workflows, or AI agents.

### Step 4 — Choose which roles can execute actions

In the **Roles for which Google Admin actions are enabled** field, select the Siit roles that should be allowed to run Google Workspace actions (e.g., `admin`, `Owner`).

Google Admin actions will only be available in requests assigned to the selected teams. Users with roles that are not selected will not see or be able to execute these actions.

### Step 5 — Confirm

Click **Configure** to save. Siit authorizes the connection with Google and the actions become available immediately in:

* The request side panel (manual execution)
* The workflow action picker under **Third-party applications → Google Workspace**
* The AI agent action library

### Can I connect without the group management scope?

Yes. If you only need directory sync (employee profiles, group membership visibility), skip the additional scope. Siit will sync your directory but group actions will not be available. You can add the scope later by reconfiguring the integration.

#### How do I add a user to a Google Group from a request?

1. Open the request in the admin console.
2. In the side panel, locate the **Google Workspace** section.
3. Click **Add to Google Group**.
4. Search for and select the target group.
5. Confirm the action.

The action executes immediately and is logged in the request timeline.

<figure><img src="https://2274035325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlWFhpq2ia6gdHet0opKx%2Fuploads%2Fgit-blob-3bbfff8746de48e7c087bbdded454431c7cc1f78%2FCleanShot-2026-02-11-at-16-25-17-png.png?alt=media" alt="Google group action on a Siit request"><figcaption></figcaption></figure>

### How do I use Google Workspace Actions in a workflow?

#### Example: auto-provision group access on onboarding

1. Go to **Workflows** and create or edit a workflow.
2. Choose your trigger (e.g., **People trigger → Start date**).
3. Add conditions if needed (e.g., Department = Marketing).
4. Add an action → **Google Workspace → Add user to Google Group**.
5. Select the group (e.g., `marketing-team@yourcompany.com`).
6. Save and publish the workflow.

#### Example: remove all group access on offboarding

1. Trigger: **People trigger → End date**.
2. Action: **Google Workspace → Remove user from Google Group**.
3. Repeat for each group, or combine with a branching path to handle department-specific groups.

<figure><img src="https://2274035325-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlWFhpq2ia6gdHet0opKx%2Fuploads%2Fgit-blob-89521572b2ffef35ea20584c11fe6c1691e03a4b%2FCleanShot-2026-03-09-at-14-20-24-png.png?alt=media" alt=""><figcaption></figcaption></figure>

#### How do I use Google Workspace Actions with AI agents?

In your agent playbook, reference the actions inline:

Step 1: Confirm which Google Group the employee needs access to\
Step 2: /google add to group (Approval required)\
Step 3: Notify the requester that access has been granted

You can gate the action with an approval step. The agent will request approval in Slack or Teams and continue once it is granted.

#### Troubleshooting

**I don't see Google Workspace actions in the side panel** Verify that Google Workspace is connected in **Settings → Workspace → Integration library** and that your admin role has permission to execute these actions.

**The action failed with a permissions error** Check that the Siit service account has the required Google Admin scopes. Re-authorize the integration if scopes were updated recently.

**I can't find a specific Google Group** Groups must exist in your Google Workspace directory. Siit pulls the group list from Google; if a group was just created, allow a few minutes for sync.

**The workflow action didn't trigger** Confirm that the trigger conditions match. Check the workflow run log for details.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.siit.io/guides/integrations/integrations-iam/how-do-i-set-up-google-workspace-actions.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.