>
    Strata Copilot
    Set up Google Workspace for Integration
    Focus
    Download PDF
    Focus
    1. Home
    2. Device Security
    3. Device Security Integration Guide
    4. Asset Management
    5. Integrate Device Security with Google Workspace
    6. Set up Google Workspace for Integration
    Download PDF
    Device Security

    Set up Google Workspace for Integration

    Table of Contents

    Set up Google Workspace for Integration

    Configure a Google Cloud service account and domain-wide delegation to allow Device Security to access your Google Workspace device data.
    Where Can I Use This?What Do I Need?
    • Device Security (Managed by Strata Cloud Manager)
    • (Legacy) IoT Security (Standalone portal)
    One of the following subscriptions:
    • Device Security subscription
    • Precision AI bundle subscription
    • Device Security X subscription
    One of the following Cortex XSOAR setups:
    • A free, cohosted, limited-featured Cortex XSOAR instance
    • A full-featured Cortex XSOAR server
    To let Device Security learn about devices and device attributes from your Google Workspace environment, you need a Google Cloud service account with domain-wide delegation enabled and authorization to access the Google Workspace APIs. The service account needs administrator privileges to read Chromebook and mobile device information through the Google Admin SDK Directory API.
    After completing this setup, save the following information for later, when you configure the integration in Device Security:
    • The email address of the Google Workspace administrator you used to configure domain-wide delegation for the API
    • Your Google Workspace Customer ID
    • The JSON key file for your service account
    1. Create a Google Cloud service account with domain-wide delegation.
      1. Sign in to the Google Cloud Console.
      2. Select an existing Google Cloud project, or create a new one.
      3. Go to IAM & AdminService Accounts.
      4. Click Create Service Account and complete the service account setup.
      5. Open the service account, select Details, enable Google Workspace Domain-Wide Delegation, and then Save.
      6. Save the service account's Client ID. You need this value when configuring domain-wide delegation in the Google Admin Console.
    2. Configure domain-wide delegation in the Google Admin Console.
      1. Sign in to the Google Admin Console using a Google Workspace administrator account.
      2. Go to SecurityAccess and data controlAPI controlsDomain-wide delegation.
      3. Click Add new, enter the Client ID of your service account, and add the following OAuth scopes as comma-separated values:
        • https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly
        • https://www.googleapis.com/auth/admin.directory.device.mobile.readonly
      4. Authorize the domain-wide delegation configuration.
    3. Create a JSON key for the service account.
      1. Return to the Google Cloud Console.
      2. Select the project containing the service account, and then open the service account.
      3. Select KeysAdd KeyCreate new key.
      4. Select JSON as the key type and Create the key.
      5. Save the downloaded JSON file to a secure location. You need this file when configuring the integration in Device Security.
    4. Locate your Google Workspace Customer ID in the Google Admin Console.
      1. In the Google Admin Console, go to AccountAccount settings.
      2. Copy the Customer ID and store it in a secure location. You enter this value in Device Security when configuring the integration in Device Security.

    © 2026 Palo Alto Networks, Inc. All rights reserved.