> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiomancer.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace

> Connect Google Workspace to Layer with one-click admin-consent OAuth — sync users, groups, devices, drives, and SaaS app activity for identity governance.

The Google Workspace integration syncs users, groups, and OAuth app activity. No Google Cloud project required — the connecting super-admin signs in once and grants admin consent.

## What you'll need

* Google Workspace **Super Admin** role (or a custom admin role with Reports and Directory read access).
* Two minutes.

## Set it up

<Steps>
  <Step title="Open the Google Workspace integration in Layer">
    In Layer, go to **Integrations**, find Google Workspace, and click **Connect**.
  </Step>

  <Step title="Sign in with your super-admin account">
    You'll be redirected to Google's sign-in screen. Use the super-admin account for the Workspace tenant you want to connect.
  </Step>

  <Step title="Grant admin consent">
    Google will show the requested scopes and ask for admin consent on behalf of the entire tenant. Click **Allow**.

    Scopes requested:

    * `admin.directory.user.readonly` — list users
    * `admin.directory.group.readonly` — list groups and membership
    * `admin.reports.audit.readonly` — read audit logs to discover OAuth app installs
  </Step>

  <Step title="Wait for the first sync">
    The initial sync runs immediately and typically finishes in 10–30 minutes depending on directory size.
  </Step>
</Steps>

## What gets synced

| Object                           | Fields                                                  | Refresh cadence |
| -------------------------------- | ------------------------------------------------------- | --------------- |
| Users                            | name, email, suspended state, last login                | Every 6 hours   |
| Groups                           | name, description, member emails                        | Every 6 hours   |
| OAuth app grants                 | app name, scopes, granting users, install date          | Daily           |
| OAuth app **Uses** relationships | per-user → app links with the scopes each user approved | Daily           |

## Token refresh

Google access tokens expire approximately one hour after they are issued. Layer automatically refreshes tokens in the background each time a sync runs, so your connection stays active without any manual re-authorization. If a refresh fails — for example, because the admin revoked access in the Google Admin console — the connection status changes to **needs re-auth** and you can reconnect with one click.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Google says I'm not authorized">
    Only Super Admins (or admins with the Reports and Directory roles) can grant the consent this integration needs. Sign in with a super-admin account.
  </Accordion>

  <Accordion title="Connection shows needs re-auth">
    This means Layer could not refresh the access token automatically. The most common cause is a revoked grant. Go to **Integrations → Google Workspace** and click **Reconnect** to re-authorize.
  </Accordion>

  <Accordion title="I want to disconnect">
    Go to **Integrations → Google Workspace → Disconnect** in Layer. To fully revoke, also remove Axiom from your tenant at [admin.google.com/ac/owl/list?tab=apps](https://admin.google.com/ac/owl/list?tab=apps).
  </Accordion>
</AccordionGroup>