Google Workspace Identity and Asset Sync

Purpose

This guide explains how to sync Google Workspace users and devices (ChromeOS and mobile) into Logsign USO's Identities and Assets enrichment, so logs can be enriched with the acting user's department, display name, phone number, and similar attributes, and devices can be looked up by owner.

Note: this is a separate capability from the Google Workspace Response Integration (which suspends/reactivates users) and from Google Workspace SSO Login. All three share the same Google Workspace configuration screen in Logsign, but each authenticates with a different scope set: identity/asset sync uses the same Domain-Wide Delegation service account as the Response integration, but with read-only Directory API scopes instead of (or in addition to) the write scope the Response integration needs. Configuring one does not configure the others.

Prerequisites

• A Google Cloud service account with domain-wide delegation, the same kind used for the Google Workspace Response integration. You can reuse an existing one or create a dedicated one; either way it needs the additional scopes in Step 1 authorized for it.
• A Google Workspace Super Admin (or an admin with domain-wide delegation authorization rights) to authorize scopes in the Admin console.
• On the Logsign side, access to Settings > Integrations > Responses.

Step 1: Authorize Identity and Asset Scopes

In the Google Workspace Admin console (admin.google.com), sign in as a Super Admin and go to Security > Access and data control > API controls > Manage Domain Wide Delegation. Find the entry for your service account's Client ID (or add a new one, following the same steps as the Response integration guide), and make sure its OAuth scopes include all of the scopes you intend to use:

Domain-Wide Delegation authorizes a client ID's scopes as a single set: if you are adding these to the same service account already used for the Response integration's write scope, add these five alongside it rather than replacing it. If a device scope is missing, device sync for that device type silently returns no results rather than failing the whole sync.

Step 2: Configure the Integration in Logsign USO

In Logsign USO, go to Settings > Integrations > Responses, search for Google Workspace, click Configure, then open your existing Google Workspace device (or create one with +Device if you have not already configured the Response integration or SSO login).

Step 3: Sync Identities and Assets

1. Go to Settings > Enrichment > Identities, click the sync tab in the upper right corner, select the Google Workspace source you configured above, and sync.
2. Once synced, select each user you want to be recognized in Logsign, click Apply Role Selected, and assign a role.
3. Devices sync the same way under Settings > Enrichment > Assets, once the device scopes from Step 1 are authorized.

Manual sync (the steps above) always works regardless of the Sync Interval setting. Automatic sync also runs on the schedule configured in Step 2, and one source failing to sync does not block others from syncing.

What Gets Synced

Identities: username and email, display/given/family name, domain, mobile phone, job title, department, org unit path, and the Google user ID (used internally to match records across syncs).

Assets: ChromeOS devices (serial number, OS version, assigned user) and mobile devices (serial number, OS, owner), each identified by their Google device ID.

Notes and Limits

• Identity and asset sync always target the whole directory (or the whole customer, if Customer ID is set) rather than a single organizational unit or group filter; there is no scoping option in the current implementation.
• If the device scopes are not authorized, ChromeOS/mobile asset sync returns an empty list rather than an error; identity sync is unaffected and continues to work.
• This sync engine is shared with the LDAP and Microsoft Entra ID identity sources; the Sync Interval field and its once-daily 02:00 default behave identically across all three.

Troubleshooting