Google Workspace

1. Go to Google Cloud Console.
   Sign in with your Google account used to set up Google Workspace.
2. Click on the project selector (top-left dropdown near “Google Cloud”).
3. Click “New Project” to configure the project with all the necessary details:
   • Project Name: Enter a unique name for your project (For example: AirMDR).
   • Organization & Location: Enter airmdr.com as organization and location or your organization and your location.
4. Click Create.
   Now you have Successfully created a New Organization and Project in GCP
   
   Only the creator of the project has the right to manage the project.

1. Go to Google Cloud Console → APIs & Services.
2. Click Enable APIs and services in the top menu.
3. Search for Each API:
   • Search “Admin SDK API”, click it, and click “Enable”.
   • Search “Google Workspace Alert Center API”, click it, and click “Enable”.
   • Search “Gmail API”, click it, and click “Enable”.

1. Go to the Google Cloud Console.
2. Select your project.
3. Navigate to “APIs & Services” → “OAuth consent screen” in the left-navigation pane.
4. Click Get started.
5. Configure App Information with the required details:
   • App Name: airmdr-agent
   • User Support Email: Provide an email for users to contact (For Example: your email address), and Click Next.
6. Choose Audience as Internal.
7. Provide the Developer Contact Information: (For Example: your email address), and click Next.
8. In Finish, mark the checkbox to acknowledge and accept the terms of Google User Data Policy.
9. Click “Create”.
   After successful configuration, we will now have a registered application using OAuth 2.0 for authorization and the consent screen information set
   The default token request limit for this app daily is 10,000 and can be increased on request.

1. Go to Google Cloud Console → APIs & Services → Credentials → + Create credentials → Service account.
2. On the “Create Service Account” page provide the required details:
   • Service account name: airmdr-agent
   • Service account ID: airmdr-agent
   • Service account Description: Describe what this service account will do
3. Click “Create and Continue”.
4. Assign necessary roles to grant permissions:
   • “Service Account Token Creator”
   • “Viewer” or “Editor” (if needed for managing resources)
5. Click “Done”.
6. Click on the newly created service account.
7. Go to the “Keys” tab.
8. Click “Add Key” → “Create New Key”.

{
  "type": "service_account",
  "project_id": "your-project-id",
  "private_key_id": "your-private-key-id",
  "private_key": "-----BEGIN PRIVATE KEY-----YOUR-PRIVATE-KEY\n-----END PRIVATE KEY-----\n",
  "client_email": "your-client-email",
  "client_id": "your-client-id",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "your-client-x509-cert-url",
  "universe_domain": "googleapis.com"
}

1. Go to Google Workspace Admin Console.
2. Navigate to Security → Access and data control → API controls.
3. Select Manage Domain Wide Delegation → Add a new client ID and enter the required credentials:
   • Client ID
     To retrieve Client ID:
     Navigate to Service Account in GCP and copy OAuthID
     or
     Copy from the JSON file generated while configuring the Service Account.
   • OAuth Scopes
     To retrieve OAuth Scopes:
     Navigate to Google Cloud Console → IAM & Admin → Service accounts OAuth2 Client ID (Visible in the header section of the service account)
     
     OAuth Scopes:
     https://www.googleapis.com/auth/admin.reports.audit.readonly, https://www.googleapis.com/auth/apps.alerts

     You can now authorize AirMDR to fetch emails too of your organization’s users by specifying the required scope.
     https://www.googleapis.com/auth/gmail.readonly

   
4. Click “AUTHORIZE”.
   Now you have Successfully enabled Domain-wide Delegation in Google Workspace
   AirMDR requires the JSON file generated while configuring the Service Account or an email ID that has admin access to read alerts in the Alert Center UI
   
   AirMDR Service account in GCP only needs access to:

   • admin.reports.audit.readonly: To access Google Workspace Audit Reports
   • apps.alerts: To read alerts

​

Purpose

• Authenticate access to your Google Workspace environment.
• Ensure authorization for retrieving security-related data and configuration settings.
• Maintain a consistent point of contact for system alerts or integration-related events.

​

Guidelines

• Use your primary business email ID that has Google Workspace Admin privileges.
• Ensure the account has sufficient permissions to grant scopes requested by AirMDR for monitoring and automation.
• The email ID must be actively monitored, as integration health notifications and audit-related communications may be routed to this address. Example: admin_email_id: "security-admin@yourcompany.com"
  If your organization uses service accounts for automation, the admin_email_id is still required to validate permissions and maintain traceability within audit logs.

  ​

  ✅ Summary of Retrieved Credentials

  Credential	Description
  admin_email_id	Your primary business email ID that has Google Workspace Admin privileges
  Service Account JSON file	Service Account JSON file generated in step. 4

  Securely save and share the admin_email_id, and Service Account JSON file with the AirMDR support team to configure
  or
  Self configure Google Workspace in the AirMDR Integrations Dashboard.