> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Devices

> Connect ThreatAware to Google Workspace to inventory and monitor your Google-managed devices

## Overview

The Google Devices integration enables ThreatAware to collect device information from your Google Workspace environment, providing visibility into device inventory and security posture across your Google-managed infrastructure.

<Info>
  **Connection Method**: OAuth 2.0 with Domain-Wide Delegation
  **Setup Time**: 15 minutes
  **Access Required**: Google Workspace Super Admin account
</Info>

## Data collected

The Google Devices integration provides:

* Device inventory and status
* Device compliance information
* Operating system details
* Security posture indicators

## Use cases

<CardGroup cols={2}>
  <Card title="Device Inventory" icon="list-check">
    Maintain an accurate inventory of all Google-managed devices in your organisation
  </Card>

  <Card title="Compliance Monitoring" icon="shield-check">
    Monitor device compliance with security policies
  </Card>

  <Card title="Security Posture" icon="eye">
    Track the security health of Google-managed devices
  </Card>

  <Card title="Access Control" icon="lock">
    Validate device credentials and access rights
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Access ThreatAware Integration">
    Begin the integration setup in ThreatAware:

    * Log in to the ThreatAware dashboard
    * Navigate to **Settings → Integrations**
    * Use the search bar to find **Google**
    * Click **Connect** to open the configuration wizard
  </Step>

  <Step title="Log in to Google Admin Console">
    Access Google Workspace administrative tools:

    * Go to [Google Admin Console](https://admin.google.com)
    * Sign in with a **Super Admin account**
    * Navigate to **Security** settings in the left sidebar
  </Step>

  <Step title="Enable Domain-Wide Delegation">
    Configure API permissions for ThreatAware:

    * In Google Admin Console, select **Security**
    * Scroll down and click **API Controls**
    * Under **Domain-Wide Delegation**, select **Manage Domain-Wide Delegation**
    * This enables the OAuth flow required for ThreatAware integration
  </Step>

  <Step title="Add ThreatAware as API Client">
    Register ThreatAware as an authorised API client:

    * Click **Add New** to authorise a new client
    * Enter the **Client ID** provided by ThreatAware support
    * In the OAuth scopes field, enter the following scope (comma-separated if multiple):
      ```text theme={null}
      https://www.googleapis.com/auth/cloud-identity.devices.readonly
      ```
    * Click **Authorize** to grant ThreatAware access

    <Warning>
      Only the read-only scope is required. Never grant additional permissions beyond what is specified.
    </Warning>
  </Step>

  <Step title="Configure ThreatAware with Admin Email">
    Complete the integration in ThreatAware:

    * Return to the ThreatAware integration window
    * Enter the email address of the **Super Admin account** used in Google Admin Console
    * Click the **Authorize** button to complete the setup
    * ThreatAware will initiate OAuth authentication
  </Step>

  <Step title="Verify Connection">
    Confirm successful integration:

    * Check that the integration status in ThreatAware shows **Active**
    * Wait 5-10 minutes for initial data synchronization
    * Verify Google device data appears in the ThreatAware dashboard
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Super Admin Email" icon="envelope">
    **Field Name**: Google Workspace Super Admin Email
    **Type**: String
    **Description**: Email address of a Google Workspace Super Admin account

    This account must have:

    * Super Admin privileges in Google Workspace
    * Access to the Google Admin Console
    * Permission to manage API access and domain-wide delegation

    Example: `admin@company.com`
  </Accordion>

  <Accordion title="OAuth Scope" icon="shield">
    **Field Name**: OAuth Scope
    **Type**: String
    **Description**: The API permission scope required for device access

    Required scope:

    ```text theme={null}
    https://www.googleapis.com/auth/cloud-identity.devices.readonly
    ```

    This read-only scope allows ThreatAware to:

    * View device inventory
    * Read device compliance status
    * Access device metadata
  </Accordion>

  <Accordion title="Client ID" icon="key">
    **Field Name**: ThreatAware Client ID
    **Type**: String
    **Description**: The Client ID provided by ThreatAware support for OAuth registration

    This ID uniquely identifies ThreatAware as an authorised application in Google Workspace.
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings → Integrations** in ThreatAware
   * Confirm Google shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 5-10 minutes for initial data synchronization
   * Search the ThreatAware dashboard for Google device data
   * Verify device inventory matches Google Admin Console

3. **Test Queries**
   * Create a test query filtering by Google-managed devices
   * Verify device names and metadata match your Google Workspace inventory

## Troubleshooting

<AccordionGroup>
  <Accordion title="Incorrect OAuth Scopes" icon="triangle-exclamation">
    **Symptoms**: Integration fails with scope error or shows limited permissions

    **Solutions**:

    * Double-check the scope entry in Google Admin Console exactly matches:
      ```text theme={null}
      https://www.googleapis.com/auth/cloud-identity.devices.readonly
      ```
    * Verify there are no extra spaces or special characters
    * If the scope was entered incorrectly, remove the client and add it again with the correct scope
  </Accordion>

  <Accordion title="Authentication Failure" icon="ban">
    **Symptoms**: OAuth authorization fails or returns permission denied error

    **Solutions**:

    * Ensure the email address is for a **Super Admin** account
    * Verify the account has access to Google Admin Console
    * Confirm Domain-Wide Delegation is enabled
    * Try authorising again with a different Super Admin account
    * Check that the Client ID in Google Admin Console matches ThreatAware's Client ID
  </Accordion>

  <Accordion title="No Device Data Appearing" icon="database">
    **Symptoms**: Integration shows active but no Google devices appear in ThreatAware

    **Solutions**:

    * Verify you have Google-managed devices enrolled in Google Workspace
    * Check that the OAuth scope is correctly configured
    * Ensure the Super Admin account has access to view devices
    * Wait up to 15 minutes for initial data synchronization
    * Review Google Admin Console to confirm devices are managed by Google
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to authenticate or frequently disconnects

    **Solutions**:

    * Verify your network allows HTTPS (443) outbound to Google APIs
    * Check that `googleapis.com` is accessible from your ThreatAware instance
    * Temporarily disable any corporate proxy or VPN and test
    * Contact Google Cloud support if API access is blocked
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Google Admin Console" icon="browser" href="https://admin.google.com">
    Access your Google Workspace administration dashboard
  </Card>

  <Card title="Google API Documentation" icon="book" href="https://developers.google.com/identity/protocols/oauth2">
    Official Google OAuth 2.0 and API documentation
  </Card>

  <Card title="Domain-Wide Delegation Guide" icon="network-wired" href="https://developers.google.com/workspace/guides/create-credentials">
    Google's guide to setting up domain-wide delegation
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Use a Dedicated Admin Account**

  * Create a dedicated Super Admin account specifically for ThreatAware integration
  * Use a different account for day-to-day administration
  * This improves security and audit trail tracking
</Tip>

<Tip>
  **Monitor API Access**

  * Periodically review API access in Google Admin Console
  * Check for any suspicious API activity logs
  * Revoke access immediately if the integration is no longer needed
</Tip>

<Tip>
  **Keep Scope Minimal**

  * Never grant additional scopes beyond the read-only device scope
  * Review Google's documentation to understand what each scope provides
  * Request only the permissions necessary for your use case
</Tip>