> For the complete documentation index, see [llms.txt](https://prohelp.assetpanda.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://prohelp.assetpanda.com/integrations-store/identity-and-access-management-iam/google-workspace-integration.md).

# Google Workspace Integration

You can connect Asset Panda Pro to your Google Admin console to import employee records into the Asset Panda directory automatically and sync Google-managed devices for tracking. This integration keeps your employee and device data current, streamlines asset management, and eliminates the need for manual updates.

The integration supports one-way and two-way synchronization. Data can be fetched from Google Workspace into Asset Panda Pro, and supported fields can be updated from Asset Panda Pro back to Google Workspace. 

{% hint style="info" %}
Two-way synchronization is limited to supported editable fields and specific entities.
{% endhint %}

1. **Enable Google Workspace Integration**: Link your Google Workspace account to Asset Panda Pro to pull in device and user data automatically.
2. **Set Up Google Device Management**: Once connected, add and manage your Google Chrome devices in Asset Panda Pro. You can activate, deactivate, or de-provision devices as needed.
3. **Sync Mobile Devices**: With Google Mobile Management, sync mobile assets to Asset Panda Pro through scheduled or manual synchronization to ensure that your mobile devices are always up to date. You can also manage devices remotely.

## Prerequisites

* Active Google Workspace account with Administrative access and permissions to configure integrations
* Asset Panda Pro subscription with Administrative access and permissions to configure integrations
* Google Directory configured for user management

***

## Set up Google Workspace  <a href="#setting-up-google-workspace" id="setting-up-google-workspace"></a>

### Set up OAuth <a href="#oauth" id="oauth"></a>

To connect Asset Panda Pro with Google Workspace, you must create OAuth 2.0 credentials in the Google Cloud Console. These credentials generate a client ID and client secret that allow Asset Panda Pro to access directory information from your Google Workspace account securely.&#x20;

1. Sign into the [Google Cloud Console](https://console.cloud.google.com/) with your Google Workspace admin account.
2. Create a new project:
   1. In the top navigation bar, select the project drop-down and select **New Project**.
   2. Enter a project name, such as <kbd>Asset Panda Integration</kbd>.
   3. Select your organization (if applicable) and then click **Create**.
3. Enable the necessary APIs.
   1. In the left navigation, select **APIs & Services** > **Library**.
   2. Search for and enable **Admin SDK**.
   3. (Optional) Enable **People API** if Asset Panda Pro will access contact or user profile data.
4. Configure the OAuth consent screen:
   1. Select **APIs & Services** > **OAuth consent screen**.
   2. Choose **Internal** (recommended for internal use) or **External**.
   3. Enter the required app details, such as the following:
      * App name: *Asset Panda Integration*
      * User support email
      * Developer contact information
   4. Save and continue through the remaining screens.
5. Create OAuth credentials:
   1. Select **APIs & Services** > **Credentials**.
   2. Click **+ Create Credentials** > **OAuth client ID**.
   3. For the application type, select **Web application.**
   4. Enter a name, such as *Asset Panda OAuth Client*.
   5. Under **Authorized redirect URI**, enter the following URIs:&#x20;
      * `https://www.assetpanda.app`
      * `https://assetpanda.app`
      * If you are using a domain-specific URL to log in, add `https://<domain>.assetpanda.app`
   6. Click **Create**. The client ID and client secret are displayed.
6. Copy the client ID and client secret.

{% hint style="warning" %}
The Client ID is a public identifier for your application. The Client Secret is a confidential string used to authorize the secure connection. Copy both values and store them securely. You’ll need them when configuring the integration in Asset Panda Pro.
{% endhint %}

***

## Asset Panda Pro tasks

### Set up the Google Workspace integration

1. Log into Asset Panda Pro with an administrator account
2. Navigate to <img src="/files/dLHka5YWbUR3zisHLua6" alt="" data-size="line"> **Settings > Account Management**.
3. Expand the appropriate account and module.
4. Click **Manage** in the **Integrations** card.
5. In the **Google Workspace** tile, click **Add**. The Integrations in this module tab is displayed.
6. In the **Google Workspace** tile, click **Configure**.
7. Enter the **Client ID** and **Client Secret** you created in the Google Cloud Console.&#x20;

{% hint style="info" %}
These values are generated when you create an OAuth 2.0 client under **APIs & Services > Credentials** in the Google Cloud Console. You can retrieve both after creating the OAuth client by selecting your credential name from the **Credentials** list.&#x20;
{% endhint %}

8. Click **Authorize** to begin the authentication process. The Google sign-in page is displayed.

   1. Sign in using a Google Workspace admin account.
   2. Review and approve the access permissions requested by Asset Panda Pro.

   After authorization, Google redirects you back to Asset Panda Pro and confirms the connection with a green check next to the authentication section.
9. Click **Test and save connection** to verify the setup and confirm that the credentials are valid.
10. Click **Continue with mapping**.
11. Click **Add mapping option**. The Mapping Option page is displayed.
12. Select the appropriate mapping path.

    * [Create Asset Panda Pro user from Google Workspace with login access](#create-users-with-login-access)\
      Use this path to create users that will log in to Asset Panda and actively use the platform.
    * [Create Google Workspace users as collection records without login access](#create-collection-records-without-login-access)\
      Use this to import user or device records into Asset Panda Pro for tracking, but without login access.

    The workflow changes based on your selection.

***

### **Create users with login access**

Use this method to create users that will log into Asset Panda Pro and actively use the platform.

1. In the Mapping Option view, select **Create Asset Panda user from Google Workspace with login access**.
2. Enter a **Mapping Name** (for example, <kbd>G1</kbd>).
3. Select the **Organizational Unit** from which users will be imported.
4. Assign a **User Role** to apply access permissions within Asset Panda Pro (for example, Collaborator or Admin).
5. In the mapping section, map fields such as:
   * First name
   * Last name
   * **Email** (required for login)
   * Any other relevant user metadata

{% hint style="info" %}
Asset Panda Pro uses a unique identifier to match users across systems and avoid duplication. In this mapping flow, **Email** is the most common and recommended unique field. You should always map the **Email** field to ensure proper identity matching and login provisioning. See [Unique identifiers for Login-Access users](#unique-identifiers-for-login-access-users).
{% endhint %}

6. Click **Save**. Users will be created in Asset Panda Pro with login access and assigned roles.

#### **Unique identifiers for Login-Access users**&#x20;

| Field                 | Description                            | Unique?        |
| --------------------- | -------------------------------------- | -------------- |
| **Email**             | User’s primary login email address     | Yes            |
| **User ID**           | Google-generated internal ID (via API) | Yes (API only) |
| First name, Last name | For display/reference only             | No             |

#### User deprovisioning  and status handling (login users only)

Asset Panda Pro does not independently delete users. All de-provisioning actions depend on the user data exposed by Google Workspace. If users are created with login access via the Google Workspace integration, Asset Panda Pro manages user deactivation based on the user’s status in Google Workspace and the availability of user data through Google APIs.

* **Deactivated/archived users:** If a user is archived or otherwise deactivated in Google Workspace, the user information remains accessible via APIs and the corresponding **Asset Panda Pro login user is deactivated** during the next sync.
* **Deleted users:** If a user is **permanently deleted** from Google Workspace, Google does not expose the user data via APIs. In this case, Asset Panda Pro **cannot retrieve or deactivate** the user record.

***

### **Create collection records (without login access)**

Use this method to import user or device records into Asset Panda Pro for tracking, without login access.

1. In the **Mapping Option** view, select **Create Google Workspace users as collection records without login access**.
2. Enter a **Mapping Name** (for example, <kbd>G2</kbd>).
3. Select the **External Entity** from Google Workspace to import:
   * **Users**
   * **Mobile Devices**
   * **Chrome OS Devices**
   * **Organisational units**
4. Select the **Asset Panda Collection** to store the imported records (for example, **People**, **Hardware**, **Devices**).&#x20;
5. Select a **Unique Identifier** (for example: Device ID, Email, Serial Number).

{% hint style="info" %}
The field you select must be marked as unique in both systems. See [Unique identifiers](#unique-identifiers).&#x20;
{% endhint %}

5. Confirm the corresponding **Object ID** in Asset Panda Pro .
6. Click **Add more** to map additional fields (for example, **Name**, **Status**, **IMEI**, **OS version**, or **Last Login**).
7. Click **Save**. Asset Panda Pro will pull in collection records based on your configuration.

{% hint style="info" %}
You can set up an automation to ensure data stays up to date by syncing records at scheduled intervals.
{% endhint %}

#### Enable two-way synchronization

Optionally, you can configure two-way synchronization to allow updates made in Asset Panda Pro to be pushed to Google Workspace to ensure consistent and up-to-date data across both systems for supported entities. &#x20;

Two-way sync requires a separate mapping configuration and can be enabled only for data loading in Collection .

1. Create a new mapping.
2. Select **Sync Direction: Asset Panda → Google Workspace**
3. Map the [supported entities and fields](#supported-entities).

{% hint style="info" %}
Only supported fields are available for selection during mapping.
{% endhint %}

4. Save the mapping.
5. Run the synchronization via a manual or scheduled automation. Updates in Asset Panda Pro are reflected in Google Workspace.

{% hint style="info" %}

* Field-level validation ensures only supported fields are updated.
* Real-time sync is not supported.
* Sync behavior depends on automation timing.
* Updates are pushed during sync execution.
* If updates occur in both systems, the system that syncs last takes precedence.
  {% endhint %}

6. Review integration logs for information about the synchronization.

#### Supported entities&#x20;

<table><thead><tr><th width="151.95703125" valign="top">Entity</th><th valign="top">Supported Fields</th></tr></thead><tbody><tr><td valign="top"><strong>Chrome OS Devices</strong></td><td valign="top"><ul><li>Asset ID</li><li>Location</li><li>Notes</li><li>Organization Unit Path</li><li>Serial Number</li><li>User</li></ul></td></tr><tr><td valign="top"><strong>Organizational Units</strong></td><td valign="top"><ul><li>Description</li><li>Name</li><li>Organization Unit ID</li><li>Parent Organization Unit Path</li></ul></td></tr><tr><td valign="top"><strong>Users (Collection Records Only)</strong></td><td valign="top"><p>Two-way sync is supported only when users are synced as collection records (without login access).</p><p>Write-back is <strong>not supported</strong> for users created with login access.</p><ul><li>Alternate Email</li><li>Cost Center</li><li>Department</li><li>Email</li><li>Employee Number</li><li>Employee Type</li><li>First Name</li><li>Home Address</li><li>Home Phone Number</li><li>Job Title</li><li>Last Name</li><li>Manager Email</li><li>Mobile Phone Number</li><li>Office Address</li><li>Office Phone Number</li></ul></td></tr></tbody></table>

#### **Unique Identifiers**

When mapping fields, you must select a **Unique Identifier** from Google Workspace that ensures each record is imported uniquely. The fields available vary based on the selected **External Entity**:

* **Users**:
  * **Email**: Primary email address
  * **Customer ID**: Organization-wide ID (not per user)
  * **User ID**: Google system-generated ID (API only)
* **Mobile Devices**:
  * **Device ID**: Unique Google-assigned ID
  * **Serial Number**: Manufacturer serial number
  * **IMEI**: Device IMEI
  * **WiFi MAC**: Network MAC address
* **Chrome OS Devices**:
  * **Serial Number**: Chrome OS device serial
  * **Asset ID**: Custom admin-assigned ID
  * **Directory API ID**: Internal device ID via Admin SDK

***

### Device management actions

The Google Workspace integration supports automated device actions, enabling you to manage Google-managed devices directly from Asset Panda Pro.&#x20;

You can select **Device Management** when configuring the automation to enable the following actions:

* **Wipe**: Remove device data
* **Delete**: Remove the device from Google Workspace
* **Deprovision (Chrome OS only)**
* **Disable (Chrome OS only)**

The actions can be triggered record updates, form submissions, or status changes and run as part of automation workflows. Results can be reviewed in integration logs.

#### **Permissions for managing devices and users** <a href="#permissions-for-managing-devices-and-users" id="permissions-for-managing-devices-and-users"></a>

**Device Management**

The following permissions manage metadata for devices and organizational structure relevant to devices:

| Permission                        | Description                                           |
| --------------------------------- | ----------------------------------------------------- |
| `admin.directory.device.chromeos` | View and manage metadata for Chrome OS devices.       |
| `admin.directory.device.mobile`   | View and manage metadata for mobile devices.          |
| `admin.directory.customer`        | View and manage customer-level configuration details. |
| `admin.directory.orgunit`         | View and manage organizational units.                 |

**User Management**

The following permissions manage users, groups, and related structures:

| Permission                   | Description                                   |
| ---------------------------- | --------------------------------------------- |
| `admin.directory.user`       | View and manage user accounts.                |
| `admin.directory.userschema` | View and manage custom user schema fields.    |
| `admin.directory.group`      | View and manage groups and their memberships. |
| `admin.directory.orgunit`    | View and manage organizational units.         |
| `admin.directory.customer`   | View and manage customer-level settings.      |