Google Workspace Integration

Overview

The Google Workspace integration connects your organization’s Google Workspace domain to Fencer for identity management and SaaS security scanning. In the catalog it is listed as Google Workspace. Once connected, Fencer syncs your Workspace users and runs security checks against your domain configuration on a schedule to identify misconfigurations such as weak MFA policies, excessive admin privileges, and permissive sharing settings.

Prerequisites

• A Google Workspace Super Admin account, or a delegated admin with access to the Admin SDK Directory API (required to authorize the OAuth scopes).
• Your Google Workspace domain must allow third-party applications to access admin APIs.
• A valid Fencer subscription and the Administrator role in your Fencer organization.
• After connecting, the Fencer app must be marked as Trusted in your Google Workspace Admin Console and exempted from the Google Cloud session control reauthentication policy (see Exempting Fencer from session reauthentication and Marking Fencer as a Trusted app below).

How it works

When you connect Google Workspace, Fencer initiates an OAuth 2.0 flow that requests read-only access to your Admin Directory (users, groups, organizational units, and customer info), the Reports API, and user security settings. You must allow every requested permission on Google’s consent screen; if any is left unticked, Fencer does not create the connection. After authorization, Fencer stores encrypted OAuth tokens and associates the connection with your organization’s primary domain.

Fencer creates a SaaS account asset for your domain and triggers two automated workflows: an identity sync that imports all Workspace users (including their roles, MFA status, and login activity), and a SaaS security scan that evaluates your domain against a set of security checks. Both then repeat on a schedule: the security scan runs daily (weekly on plans without daily scans), and the identity sync runs daily when your plan includes identity management.

If this is the first integration in your organization that can act as an identity provider, Fencer makes it the primary identity source automatically.

Usage / Configuration

Connecting Google Workspace

1. Navigate to Admin > Integrations in your organization.
2. Click the Google Workspace card, then click Continue.
3. Review the requested permissions and click Connect Google Workspace to begin the OAuth flow.
4. Sign in with your Google Workspace admin account if prompted, and click Allow.
5. After authorization, you are redirected back to Fencer. The integration is now active and your domain appears as a connected SaaS account.

Exempting Fencer from session reauthentication

If your organization enforces a Google Cloud session control reauthentication policy, Fencer’s token refreshes will fail periodically unless trusted apps are exempted. Configure this before marking Fencer as Trusted so the exemption takes effect as soon as the Trusted status is applied.

1. Sign in to the Google Workspace Admin Console.
2. Navigate to Security > Access and data control > Google Cloud session control.
3. Under Reauthentication policy, if Require reauthentication is selected, check the Exempt Trusted apps checkbox.
4. Click Save.

Note

If your reauthentication policy is set to Never require reauthentication, you can skip this section.

Marking Fencer as a Trusted app

After connecting, mark Fencer as a Trusted app in your Google Workspace Admin Console. This ensures that Google does not block Fencer’s API access due to reauthentication or Context-Aware Access policies.

1. Sign in to the Google Workspace Admin Console.
2. Navigate to Security > Access and data control > API Controls.
3. Click Manage App Access.
4. Find and click Fencer in the app list.
5. Expand the Access to Google data section.
6. Set the access level to Trusted.
7. If your organization enforces Context-Aware Access policies, check the Exempt from having API access blocked by Context-Aware Access levels checkbox.
8. Click Save.

Caution

Skipping this step can cause token refresh failures. If Fencer is not marked as Trusted, Google may block API calls and require reauthentication that cannot be completed programmatically.

Setting as primary identity source

If Google Workspace is your organization’s primary directory, you can designate it as the primary identity source:

1. Navigate to Admin > Integrations and find your Google Workspace connection.
2. Click Edit on the connection.
3. Turn on Primary Identity Source and click Save changes.

Note

If another integration is already set as primary, you are asked to confirm the change (Change Primary Identity Source?). Only one integration can be the primary identity source at a time.

Reconnecting

To refresh Google tokens or permissions without disconnecting, open the connection’s edit page and click Reconnect. This re-runs the Google authorization for the same connection.

Disconnecting

To disconnect the integration, click Remove on the connection in Admin > Integrations and confirm. Fencer deletes the stored tokens and removes the connection and its vendor record. To also revoke Fencer’s access on Google’s side, remove Fencer under Security > Access and data control > API Controls in the Google Workspace Admin Console.

Security checks

Once connected, Fencer runs the following SaaS security checks against your Google Workspace domain:

Check	Severity	What it detects
Two-factor authentication is not enforced	High	Domain has users with 2FA enrolled but not enforced by policy. Highlights affected admin accounts.
Too many super admins	High	More than 3 active super admin accounts, suspended accounts retaining admin roles, or admins inactive for 90+ days.
Inconsistent MFA enrollment	Medium	Users under a 2FA enforcement policy who have not completed enrollment, leaving them able to bypass MFA during the grace period.
Weak MFA methods in use	Medium	Users authenticating with SMS or phone-call-based MFA, which are vulnerable to SIM-swapping attacks.
Third-party app with a known compromise	High	Users who have granted Google Workspace access to an OAuth application with a publicly known compromise.
Default external sharing is permissive	Medium	Google Drive sharing settings allow files to be shared outside the organization.
Unmonitored domain-wide delegation	High	Service accounts with both admin and data-access scopes via domain-wide delegation.
Audit logging is disabled	High	No recent events found in admin or Drive audit logs, which prevents retroactive incident investigation.
Missing Data Loss Prevention (DLP) rules	Medium	No DLP rule activity detected for the domain in the past year.

Identity sync

The integration syncs Google Workspace users into Fencer’s identity management system. Each user record includes:

• Email and display name
• Role (admin, delegated admin, or member)
• Status (active, suspended, or deprovisioned)
• Identity type (user or service account)
• MFA enrollment status
• Last login timestamp

Deleted and suspended users are also tracked so you can identify stale accounts. The sync runs automatically when the integration is first connected, then daily, and you can start it at any time with Sync Identities on Posture > Identities.

Google Workspace Monitor (SIEM)

The separate Google Workspace (Monitor) integration forwards Google Workspace audit events to Security Monitoring, where detection rules evaluate them. Fencer polls the Google Workspace Reports API every two minutes with read-only access to audit reports (admin.reports.audit.readonly). It needs a Fencer plan that includes Security Monitoring, a Google Workspace Super Admin to sign in, and a tenant that allows third-party security applications to access audit data.

1. Go to Admin > Integrations, click the Google Workspace (Monitor) card, and click Continue.
2. Enter an Integration Name (for example, primary-domain).
3. Click Connect Google Workspace Monitor and sign in with a Super Admin account to grant access. Fencer refreshes the credentials automatically from then on.

If Google reports that your admin policy blocks Fencer, allow the app under Security > Access and data control > API controls in the Google Admin console and try again. The connect wizard notes that sign-in may not be enabled yet while Fencer’s Google Workspace Marketplace listing is under review; in that case Fencer contacts you to complete provisioning. After connecting, the edit page lets you rename the connection or click Reconnect to grant access again.

Troubleshooting

• “This Google account isn’t part of a Google Workspace organization, or you don’t have admin access” — The authorizing account is not a Workspace admin. Re-authorize with a Super Admin account (or a delegated admin with Admin SDK Directory API access).
• “Google Workspace was not connected because some of the requested permissions were not granted” — A permission was unticked on Google’s consent screen. Connect again and allow every permission.
• Connecting the same domain again — Fencer matches the Google Workspace account and updates the existing connection instead of creating a second one.
• Token refresh blocked by reauthentication — Google’s reauthentication (RAPT) or Context-Aware Access policies can block Fencer’s token refresh, and the connection then reports “Google Workspace authentication failed. The integration may need to be reconnected.” Ensure both the Google Cloud session control Exempt Trusted apps setting is enabled (see Exempting Fencer from session reauthentication) and the Fencer app is marked as Trusted with the Context-Aware Access exemption enabled (see Marking Fencer as a Trusted app). After updating the policies, click Reconnect on the connection’s edit page to obtain a fresh token.
• “Google Workspace refresh token is no longer valid” — The OAuth grant was revoked (for example, in the Google Admin Console, or after the authorizing user’s password changed). Click Reconnect on the connection’s edit page.

Related pages

• Integrations Overview
• Identity Management
• SaaS Scanning
• Security Monitoring (SIEM)