> For the complete documentation index, see [llms.txt](https://prohelp.assetpanda.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://prohelp.assetpanda.com/integrations-store/user-management/google-workspace-integration.md).

# Google Workspace Integration

You can connect Asset Panda Pro to your Google Admin console to import employee records into the Asset Panda directory automatically and sync Google-managed devices for tracking. This integration keeps your employee and device data current, streamlines asset management, and eliminates the need for manual updates.

1. **Enable Google Workspace Integration**: Link your Google Workspace account to Asset Panda Pro to pull in device and user data automatically.
2. **Set Up Google Device Management**: Once connected, add and manage your Google Chrome devices in Asset Panda Pro. You can activate, deactivate, or de-provision devices as needed.
3. **Sync Mobile Devices**: With Google Mobile Management, sync mobile assets to Asset Panda Pro in real time to ensure that your mobile devices are always up to date. You can also manage them remotely, if needed.

## Prerequisites

* Active Google Workspace account with Administrative access and permissions to configure integrations
* Asset Panda Pro subscription with Administrative access and permissions to configure integrations
* Google Directory configured for user management

***

## Set up Google Workspace  <a href="#setting-up-google-workspace" id="setting-up-google-workspace"></a>

### Set up OAuth <a href="#oauth" id="oauth"></a>

To connect Asset Panda Pro with Google Workspace, you must create OAuth 2.0 credentials in the Google Cloud Console. These credentials generate a client ID and client secret that allow Asset Panda Pro to access directory information from your Google Workspace account securely.

1. Go to the [Google Cloud Console](https://console.cloud.google.com/) and sign in with your Google Workspace admin account.
2. Create a new project:
   1. In the top navigation bar, select the project drop-down and select **New Project**.
   2. Enter a project name, such as `Asset Panda Integration`.
   3. Select your organization (if applicable) and then click **Create**.
3. Enable the necessary APIs:
   1. In the left navigation, select **APIs & Services** > **Library**.
   2. Search for and enable **Admin SDK**.
   3. (Optional) Enable **People API** if Asset Panda Pro will access contact or user profile data.
4. Configure the OAuth consent screen:
   1. Go to **APIs & Services** > **OAuth consent screen**.
   2. Select **Internal** (recommended for internal use) or **External**.
   3. Enter the required app details, such as the following:
      * App name: `Asset Panda Integration`
      * User support email
      * Developer contact information
   4. Save and continue through the remaining screens.
5. Create OAuth credentials:
   1. Go to **APIs & Services** > **Credentials**.
   2. Click **Create Credentials** > **OAuth client ID**.
   3. For the application type, select **Web application.**
   4. Enter a name, such as `Asset Panda OAuth Client`.
   5. Under **Authorized redirect URI**, enter the following URIs:&#x20;
      * `https://www.assetpanda.app`
      * `https://assetpanda.app`
      * If you are using a domain-specific URL to log in, add `https://<domain>.assetpanda.app`
   6. Click **Create**. The client ID and client secret are displayed.
6. Copy the client ID and client secret.

{% hint style="warning" %}
The Client ID is a public identifier for your application. The Client Secret is a confidential string used to authorize the secure connection. Copy both values and store them securely. You’ll need them when configuring the integration in Asset Panda Pro.
{% endhint %}

***

## Asset Panda tasks

### Set up the Google Workspace integration

1. Log into Asset Panda Pro with an administrator account
2. Navigate to <img src="/files/dLHka5YWbUR3zisHLua6" alt="Settings icon" data-size="line"> **Settings** > **Account Management**.
3. Expand the appropriate account and module.
4. Click **Manage** in the **Integrations** card.
5. Select **Integrations Store**.
6. In the **Google Workspace** tile, click **Add**. The **Integrations in this module** tab is displayed.
7. In the **Google Workspace** tile, click **Configure**.
8. Enter the **Client ID** and **Client Secret** you created in the Google Cloud Console.&#x20;
9. Click **Authorize** to begin the authentication process. The Google sign-in page.

   1. Sign in using a Google Workspace admin account.
   2. Review and approve the access permissions requested by Asset Panda Pro.

   After authorization, Google redirects you back to Asset Panda Pro and confirms the connection with a green check next to the authentication section.
10. Click **Test and save connection** to verify the setup and confirm that the credentials are valid.
11. Click **Continue with mapping**.
12. Click **Add mapping option**. The **Mapping Option** page is displayed.
13. Select the appropriate mapping path.&#x20;

    * [**Create Asset Panda Pro user from Google Workspace with login access**](#create-users-with-login-access)\
      Use this path to create users that will log in to Asset Panda and actively use the platform.
    * [**Create Google Workspace users as collection records without login access**](#create-collection-records-without-login-access)\
      Use this to import user or device records into Asset Panda Pro for tracking, but without login access.

    The workflow changes based on your selection.

### **Create users with login access**

1. In the Mapping Option view, select **Create Asset Panda user from Google Workspace with login access**.
2. Enter a **Mapping Name** (for example, `G1`).
3. Select the **Organizational Unit** from which users will be imported.
4. Assign a **User Role** to apply access permissions within Asset Panda Pro (for example, Collaborator or Admin).
5. In the mapping section, map fields such as:
   * First name
   * Last name
   * **Email** (required for login)
   * Any other relevant user metadata

{% hint style="info" %}
Asset Panda Pro uses a unique identifier to match users across systems and avoid duplication.\
In this mapping flow, **Email** is the most common and recommended unique field. You should always map the **Email** field to ensure proper identity matching and login provisioning. See [Unique identifiers for Login-Access ](#unique-identifiers-for-login-access-users)users.
{% endhint %}

6. Click **Save**. Users will be created in Asset Panda with login access and assigned roles.

#### **Unique identifiers for Login-Access users**

<table><thead><tr><th width="196.7578125">Field</th><th>Description</th><th>Unique?</th></tr></thead><tbody><tr><td><strong>Email</strong></td><td>User’s primary login email address</td><td>Yes</td></tr><tr><td><strong>User ID</strong></td><td>Google-generated internal ID (via API)</td><td>Yes (API only)</td></tr><tr><td>First name, Last name</td><td>For display/reference only</td><td>No</td></tr></tbody></table>

#### User de-provisioning & Status Handling (Login users only)

Asset Panda Pro does not independently delete users. All de-provisioning actions depend on the user data exposed by Google Workspace.

If users are created with login access via the Google Workspace integration, Asset Panda Pro manages user deactivation based on the user’s status in Google Workspace and the availability of user data through Google APIs.

* **Deactivated/archived users:**\
  If a user is archived or otherwise deactivated in Google Workspace, the user information remains accessible via APIs and the corresponding **Asset Panda Pro login user is deactivated** during the next sync.
* **Deleted users:**\
  If a user is **permanently deleted** from Google Workspace, Google does not expose the user data via APIs. In this case, Asset Panda Pro **cannot retrieve or deactivate** the user record.

### **Create collection records (without login access)**

1. On the Mapping Option view, select **Create Google Workspace users as collection records without login access**.
2. Enter a **Mapping Name** (for example, `G2`).
3. Select the **External Entity** from Google Workspace to import:
   * **Users**
   * **Mobile Devices**
   * **Chrome OS Devices**
4. Select the **Asset Panda Collection** to store the imported records (for example, **People**, **Hardware**, or **Devices**).&#x20;
5. Select a **Unique Identifier** (for example, Device ID, Email, or Serial Number). See&#x20;

{% hint style="info" %}
The field you select must be marked as unique in both systems. See [Unique identifiers](#unique-identifiers).
{% endhint %}

6. Select the corresponding **Object ID** in Asset Panda Pro.
7. Click **Add more** to map additional fields (for example, **Name**, **Status**, **IMEI**, **OS version**, or **Last Login**).
8. Click **Save**. Asset Panda Pro will pull in collection records based on your configuration.

{% hint style="info" %}
You can set up an automation to ensure data stays up to date by syncing records at scheduled intervals.
{% endhint %}

#### **Unique Identifiers**

When mapping fields, you must select a **Unique Identifier** from Google Workspace that ensures each record is imported uniquely. The fields available vary based on the selected **External Entity**:

* **Users**:&#x20;
  * **Email**: Primary email address
  * **Customer ID**: Organization-wide ID (not per user)
  * **User ID**: Google system-generated ID (API only)
* &#x20;**Mobile Devices:**&#x20;
  * **Device ID**: Unique Google-assigned ID
  * **Serial Number**: Manufacturer serial number
  * **IMEI**: Device IMEI
  * **WiFi MAC**: Network MAC address
* **Chrome OS Devices**:&#x20;
  * **Serial Number**: Chrome OS device serial
  * **Asset ID**: Custom admin-assigned ID
  * **Directory API ID**: Internal device ID via Admin SDK&#x20;

## **Permissions for managing devices and users** <a href="#permissions-for-managing-devices-and-users" id="permissions-for-managing-devices-and-users"></a>

### **Device Management**

The following permissions are used to access and manage metadata for devices and organizational structure relevant to devices:

<table><thead><tr><th width="293.5625">Permission</th><th>Description</th></tr></thead><tbody><tr><td><code>admin.directory.device.chromeos</code></td><td>View and manage metadata for Chrome OS devices.</td></tr><tr><td><code>admin.directory.device.mobile</code></td><td>View and manage metadata for mobile devices.</td></tr><tr><td><code>admin.directory.customer</code></td><td>View and manage customer-level configuration details.</td></tr><tr><td><code>admin.directory.orgunit</code></td><td>View and manage organizational units.</td></tr></tbody></table>

### **User Management**

The following allow access to manage users, groups, and related structures:

<table><thead><tr><th width="296.04296875">Permission</th><th>Description</th></tr></thead><tbody><tr><td><code>admin.directory.user</code></td><td>View and manage user accounts.</td></tr><tr><td><code>admin.directory.userschema</code></td><td>View and manage custom user schema fields.</td></tr><tr><td><code>admin.directory.group</code></td><td>View and manage groups and their memberships.</td></tr><tr><td><code>admin.directory.orgunit</code></td><td>View and manage organizational units.</td></tr><tr><td><code>admin.directory.customer</code></td><td>View and manage customer-level settings.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://prohelp.assetpanda.com/integrations-store/user-management/google-workspace-integration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.