Identify an Administrator Account and an Organizational Unit

1. Identify the account that SSPM will use to access your Google Workspace instance.

   When you onboard Google Workspace, SSPM gives you an option to connect with read-only permissions or with read and write permissions. The onboarding screen lists the API scopes that SSPM requires for each type of scan that it can run. The onboarding screen also lists the API scopes that SSPM requires to perform certain actions on your behalf. After establishing a connection, SSPM will notify you if it is unable to run certain scans, or complete certain actions, because the account did not have the permissions to grant access to certain scopes.

   Onboarding Google Workspace with read-only permissions will enable SSPM to perform configuration scans. Connecting with read and write permissions enables additional SSPM features, including third-part application scans and the ability to revoke a user's access to a third-party plugin. SSPM will request access to the following scopes for the following reasons.

   API Scope	Reason
   https://www.googleapis.com/auth/admin.reports.audit.readonly	SSPM uses this scope to monitor your Google Workspace instance for misconfigured settings. SSPM reads the audit logs to track configuration changes.
   https://www.googleapis.com/auth/admin.directory.user.readonly	SSPM uses this scope to identify users of third-party applications.
   https://www.googleapis.com/auth/admin.directory.user.security	SSPM uses this scope to track the third-party applications that users in your organization can access, and to revoke access.

   Permissions for Read Access: To grant SSPM reduced permissions to perform configuration scans only, the account must be assigned to an admin role that has the Reports privilege to the Admin console. To log in with a user account the has only the minimum privileges required, create a custom role that has only the Reports privilege, and assign that custom role to the user account. To create the custom role, complete the following steps:

   1. From the Google Workspace Admin Console menu, select Account > Admin roles.
   2. Create new role.

   3. Enter a name for the role and CONTINUE.
   4. Under the list of Admin Console Privileges, select only the Reports privilege and CONTINUE.
   5. Create Role.

   Permissions for Read and Write Access: To grant SSPM full read and write access to perform all of its scans and actions, the account must be assigned to the Super Admin role.
2. Identify the Google Workspace organizational unit to scan.

   An organizational unit is a grouping of users with common settings. During onboarding, you are prompted for the name of the organizational unit for SSPM to scan. If you want to scan multiple organizational units, you can onboard each one separately. To view the organizational units in your Google Workspace instance, from the Google Admin console, select DirectoryOrganizational Units.
3. Sign out of all Google Workspace accounts.

   Signing out of all Google Workspace accounts helps ensure that you sign in under the correct account during the onboarding process. Some browsers can automatically sign you in by using saved credentials. To ensure that the browser does not automatically sign you in to the wrong account, you can turn off any automatic sign-in option or clear your saved credentials. Alternatively, you can prevent the browser from using saved credentials by opening the Cloud Management Console in an incognito window.