> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matproof.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace Integration

> Connect Google Workspace to collect user access, MFA, and admin activity evidence.

## Overview

The Google Workspace integration pulls user and security data from your Google Workspace account to provide continuous evidence for identity, access control, and admin activity controls.

**Evidence collected automatically:**

* User list with roles and last login dates
* MFA (2-Step Verification) enrollment status per user
* Admin role assignments and changes
* Inactive users (no login in 90+ days)
* Super admin activity log
* Password policies (strength requirements, expiry)
* External sharing settings for Google Drive
* OAuth apps authorized by users

***

## Prerequisites

* Google Workspace Business Starter or higher (Admin Console access required)
* Matproof Admin or Owner role
* Google Workspace Super Administrator account to authorize the connection

***

## Connecting Google Workspace

1. Go to **Settings → Integrations**
2. Click **Connect** next to Google Workspace
3. Sign in with a Google Workspace Super Administrator account
4. Review and grant the requested read-only permissions
5. Select your domain and confirm

The initial sync runs immediately. Subsequent syncs run every 24 hours.

<Warning>
  A Super Administrator account is required to authorize the integration — not a delegated admin. This is a Google restriction on directory API access. Once authorized, Matproof does not retain your admin credentials.
</Warning>

***

## Permissions Requested

Matproof requests the following Google API scopes (all read-only):

| Scope                                     | What It's Used For                 |
| ----------------------------------------- | ---------------------------------- |
| `admin.directory.user.readonly`           | List users, MFA status, last login |
| `admin.directory.rolemanagement.readonly` | Admin role assignments             |
| `admin.reports.audit.readonly`            | Admin activity logs                |
| `admin.reports.usage.readonly`            | User activity and last login data  |

***

## What Gets Mapped to Which Controls

| Evidence Collected       | Control Examples                                         |
| ------------------------ | -------------------------------------------------------- |
| MFA enrollment rate      | MFA controls (SOC 2 CC6.1, DORA Art. 9, NIS2 Measure 10) |
| Inactive user accounts   | Access review / account lifecycle controls               |
| Admin role assignments   | Privileged access management controls                    |
| External sharing policy  | Data protection controls (ISO 27001 A.5.14)              |
| OAuth app authorizations | Third-party app access controls                          |

***

## Interpreting MFA Status

Matproof reports two MFA metrics:

* **Enforcement** — whether your Google Workspace policy requires 2-Step Verification for all users
* **Enrollment** — per-user status showing who has it enabled vs. who hasn't

For most compliance frameworks, **enforcement** at the policy level is the primary evidence requirement. Per-user enrollment gaps should be remediated — Matproof lists non-enrolled users so you can follow up directly.

<Tip>
  Go to **Integrations → Google Workspace → Users** and filter by "MFA: Not enrolled" to get a list of users to chase. Export as CSV to send to your IT team.
</Tip>

***

## Inactive Users

Matproof flags users who have not logged in for 90+ days as an access control risk. These accounts should be reviewed and either:

* Suspended (for employees on leave or contractors no longer active)
* Deleted (for fully departed users)
* Documented as service accounts with a justification

This evidence is mapped to your offboarding and access review controls.

***

## Common Issues

### "Authorization failed — insufficient permissions"

The Google account used to authorize must be a Super Administrator. Delegated admins with custom roles cannot grant the directory API access Matproof needs. Use a Super Admin account and try again.

### "User count doesn't match our actual headcount"

By default, Matproof includes suspended users in the count. Filter by **Status: Active** to see only active users.

### "MFA enforcement shows as not configured"

Go to Google Admin Console → Security → 2-Step Verification and ensure "Allow users to turn on 2-Step Verification" is set to **Enforce**. Simply allowing it (not enforcing) will show as a gap.

***

## Disconnecting

Go to **Settings → Integrations → Google Workspace → Disconnect**. Also revoke app access from your Google Admin Console under **Security → API Controls → App Access Control**.