TigerGate scans your Google Workspace domain’s security posture (2-Step Verification enforcement, OAuth app access, sharing settings, admin roles, and more) via a service account with domain-wide delegation, impersonating a Workspace admin.
The delegated scopes are read-only Admin SDK / Reports scopes. TigerGate can never change Workspace settings, users, or sharing policies.

​
Before you start

In TigerGate, open Integrations → Cloud Providers → Google Workspace. You’ll fill in two values once the service account exists:
ValueWhat it is
Service Account JSONThe downloaded key file for the service account created below.
Admin EmailA Workspace admin account the service account impersonates via domain-wide delegation — Workspace’s Admin SDK only allows impersonating an existing super admin or delegated admin.

​
1. Create the service account and delegate it

1

Create the service account in GCP

gcloud iam service-accounts create tigergate-cspm-scan \
  --project=<A_GCP_PROJECT> \
  --display-name="TigerGate CSPM read-only scan"

gcloud iam service-accounts keys create tigergate-cspm-key.json \
  --iam-account=tigergate-cspm-scan@<A_GCP_PROJECT>.iam.gserviceaccount.com
Any GCP project you control works — it just needs to be the project the service account lives in. Copy the service account’s numeric Client ID (Console → IAM & Admin → Service Accounts → your account → Details) for the next step.
2

Authorize domain-wide delegation in the Admin Console

In the Google Admin Console → Security → API Controls → Domain-wide Delegation → Add new, enter the service account’s Client ID and these OAuth scopes:
https://www.googleapis.com/auth/admin.reports.audit.readonly
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.domain.readonly
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
This step requires Workspace super admin access — it’s a domain setting, not a GCP IAM setting.

​
2. Connect it in TigerGate

1

Paste the JSON key and admin email

In Integrations → Cloud Providers → Google Workspace, paste the full contents of tigergate-cspm-key.json into Service Account JSON, and enter a Workspace admin’s email as Admin Email.
2

Test

Click Test. This confirms that both Service Account JSON and Admin Email are filled in — it does not yet run a live impersonation round-trip against the Admin SDK. The service account, its domain-wide delegation, and the authorized scopes are exercised for real when the first scan runs, so make sure the delegation step above is complete before scanning.
3

Scan or schedule

Run an on-demand scan, or add a Schedule under Cloud Security → Schedules. Scans run through the CSPM pipeline against the Google Workspace domain.

​
Troubleshooting

These surface when a scan runs — Test only checks that the fields are present, so credential problems appear on the first scan.
Scan errorCauseFix
unauthorized_client / Client is unauthorizedDomain-wide delegation wasn’t authorized for this Client ID, or the scopes don’t match exactlyRe-check the Client ID and scope list in the Admin Console step
Not Authorized to access this resource/apiThe Admin Email isn’t a super admin or doesn’t have the delegated admin role covering these APIsUse a super admin account, or grant a custom admin role with Reports + Directory read privileges
Service Account JSON is not valid JSONKey file was truncated or edited when pastedRe-download the key and paste the full file contents
Scan runs but few findingsOnly some of the five scopes in step 2 were authorizedRe-add the full scope list in domain-wide delegation