Google Workspace Schema of Integration Data

The integration data schema defines the structure of the data imported by the Google Workspace integration. The primary data model entities include Accounts, with mandatory and optional attributes; Credentials Types and Policies applicable at account creation and credentials rotation; Resources, categorized by resource type; and Entitlements, categorized by permission type.

Accounts

Google Workspace User Accounts are retrieved from a domain linked to a Google Workspace account during the integration data aggregation process. These user accounts are then normalized and mapped to Account objects within the Google Workspace integration data model.

Within the integration interface, the aggregated accounts can be accessed at: ObserveID > Identity Automation > Integrations > {specific Google Workspace integration} > Accounts

The schema of account additional properties is presented in the table below. Properties that are required when creating an account are marked as Required in the On Creation column. Properties that are optional at account creation, or that can be modified later, are marked as Allowed in the On Creation column or in the On Update column, respectively.

Provisioning Rules are used to define the value of a property during account creation or update when the property is required at creation or allowed to be updated. N/A indicates that no provisioning rule is defined for the property.

Custom properties are not listed below and can be added on an ad hoc basis together with the corresponding provisioning rule.

Account Property	Type	Description	Provisioning Rule	On Creation	On Update
Name	String	Account Name	Required	Required	N/A
Addresses	Strings	The list of the user's addresses. The maximum allowed data size is 10KB.	N/A	N/A	N/A
CostCenter	String	The cost center of the user's organization.	Available	Allowed	Allowed
Department	String	Specifies the department within the organization, such as `sales` or `engineering`.	Available	Allowed	Allowed
DisplayName	String	The user's display name. Limit: 256 characters.	Available	Allowed	Allowed
EmailAliases	Strings	The list of the user's alias email addresses.	N/A	N/A	N/A
EmailDelegates	Strings	The email address of the delegate. Delegates can read, send, and delete messages, as well as view and add contacts, for the delegator's account.	N/A	N/A	N/A
Emails	Strings	The list of the user's email addresses. The maximum allowed data size is 10KB.	N/A	N/A	N/A
ExternalIds	Strings	The list of external IDs for the user, such as an employee or network ID. The maximum allowed data size is 2KB.	Available	Allowed	Allowed
FamilyName	String	The user's last name. Required when creating a user account.	Required	Required	Allowed
FullName	String	The user's full name formed by concatenating the first and last name values.	Required	Required	Allowed
GivenName	String	The user's first name. Required when creating a user account.	Required	Required	Allowed
IsAdmin	Boolean	Indicates a user with super administrator privileges.	N/A	N/A	N/A
IsArchived	Boolean	Indicates if user is archived.	N/A	N/A	N/A
IsDelegatedAdmin	Boolean	Indicates if the user is a delegated administrator.	N/A	N/A	N/A
IsEnforcedIn2Sv	Boolean	Is 2-step verification enforced (Read-only)	N/A	N/A	N/A
IsEnrolledIn2Sv	Boolean	Is enrolled in 2-step verification (Read-only)	N/A	N/A	N/A
IsIncludeInGlobalAddressList	Boolean	Indicates if the user's profile is visible in the Google Workspace global address list when the contact sharing feature is enabled for the domain.	Available	Allowed	Allowed
IsMailboxSetup	Boolean	Indicates if the user's Google mailbox is created. This property is only applicable if the user has been assigned a Gmail license.	N/A	N/A	N/A
JobTitle	String	The user's title within the first organization the user pertains to.	Available	Allowed	Allowed
ManagerEmail	String	The Email of the user who has the `manager` relation type to the current user in the list of the user's relationships to other users.	Available	Allowed	Allowed
MFA Enabled	Boolean	`True` if one of the properties are established: `IsEnforcedIn2Sv` or `IsEnrolledIn2Sv`. If none of the properties are established, then the value is `False`.	N/A	N/A	N/A
MFA ParticipationType	String	One of the three types: `None`, `Enforced` or `Enrolled`, which are determined with the respective properties: `IsEnforcedIn2Sv` or `IsEnrolledIn2Sv`. If none of the properties are established, then None value is set. Otherwise, the respective value of the established property.	N/A	N/A	N/A
OrganizationalUnit	String	A sub-unit of a Google Workspace account's organizational tree, used to group and sort users for the purpose of applying policies and granting authorizations. An OU is represented by the OrgUnit resource.	Available	Allowed	Allowed
OrganizationName	String	The name of the first organization the user pertains to.	N/A	N/A	N/A
Phones	Strings	A list of the user's phone numbers. The maximum allowed data size is 1KB.	N/A	N/A	N/A
RecoveryEmail	String	Recovery email of the user.	Available	Allowed	Allowed
RecoveryPhone	String	Recovery phone of the user. The phone number must be in the E.164 format, starting with the plus sign (+). Example: +16506661212.	Available	Allowed	Allowed

Credentials Type and Policies

A password is used as the primary credential type for the user accounts created and managed with the Google Workspace integration. The available password policies are listed in the table below. A default password policy can be configured for integration operations such as account creation, credential updates, and password rotation. For Password Change requests, a password policy different from the default can be selected.

Password Policy	Description
Auto Generate Permanent Credentials	Automatically generates a permanent password.
Auto Generate One Time Credentials	Automatically generates a one time password required to be changed by the user on the first login to Google Workspace.
Set Specific Permanent Credentials	A user can establish a permanent password in alignment with the Google Workspace credentials policy requirements.
Set Specfific One Time Credentials	A user can establish a one time password in alignment with the Google Workspace credentials policy requirements. The password must be changed by the user on the first login to Google Workspace.

Resources

The resource objects are imported from Google Workspace and displayed as the resources in ObserveID. The attributes of each resource type that a specific resource belongs to are displayed as Additional Properties objects of the Resource.

Resource Property	Type	Description
Workspace resource type		The Workspace is displayed among the resources of the Google Workspace. It is the root resource. No additional properties.

Entitlements

The permission objects are imported from Google Workspace and displayed as the entitlements in ObserveID. The attributes of each permission type that a specific entitlement belongs to are displayed as Additional Properties objects of the Entitlement.

Permission Property	Type	Description
Group permission type
GroupDescription	String	An extended description to help users determine the purpose of a group. Maximum length is `4,096` characters.
GroupId	String	The unique ID of a group. A group `id` can be used as a group request URI's `groupKey`.
Admin Role permission type
RoleDescription	String	A short description of the role.
RoleId	Long	ID of the role.
RolePrivileges	Strings	The set of privileges that are granted to this role.