--- title: "Google Cloud Identity" slug: "google-cloud-identity" updated: 2025-03-26T16:59:25Z published: 2025-03-26T16:59:25Z canonical: "docs.databee.buzz/google-cloud-identity" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # Google Cloud Identity Cloud Identity is an Identity as a Service (IDaaS) solution that centrally manages users and groups. You can configure Cloud Identity to federate identities between Google and other identity providers, such as Active Directory and Microsoft Entra ID (formerly Azure AD). For more information refer to [Google Cloud Identity official documentation](https://cloud.google.com/identity#documentation). **Integration Method**: API **Tables**: Device Inventory Info (5001) This integration supports the following events. | **Event** | **Description** | | --- | --- | | Device Inventory | Retrieves a list of devices managed within an organization using Google Cloud Identity, including details on device status, ownership, and security posture. | | Company Device Inventory | Retrieves an inventory of company-managed devices in Google Cloud Identity, including details on compliance, security status, and configurations. | This integration supports the following versions. | Google Cloud Identity API Version | v1 | | --- | --- | > [!NOTE] > **Note**: > > Google Cloud Identity doesn’t follow a traditional versioning system. As of this document preparation, latest release was on [September 25, 2024](https://cloud.google.com/identity/docs/release-notes#September_25_2024). ## Prerequisites - The user should have a Google Cloud Platform (GCP) project created in their deployment. - The user should have a Google Cloud Service Account created from the Google Developers Console. - The user should have granted Domain-Wide Delegation and added the necessary scopes for the service account. - The user should have access to the DataBee console. ## Configuration Overview 1. Generate a service account with the required scopes and its private key. 2. Add the [Google Cloud Identity data feed](/user-manual/docs/google-cloud-identity#databee-configuration) in the DataBee console with the following parameters. | **DataBee Parameter** | **Google Cloud Identity Parameter** | | --- | --- | | Client Email | Service account email id | | Admin Email | Domain admin email id | | Private Key | Private Key | ## Google Cloud Identity Configuration ### Setting Up the New Project 1. Login to your [Google Cloud Platform console](https://console.cloud.google.com/). 2. On your console, click on your organization name in the Navigation bar. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-0ct6rf2k.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 3. On “Select a resource” window click on **NEW PROJECT**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-ooiff9p1.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 4. On the “New Project” window, enter your ‘Project name’ and click on **Create**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/image-1742983319910.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) ### Setting Up the service account Perform the following steps to set up Google Workspace credentials on your Google console: 1. Navigate to **console.cloud.google.com**, and log into the Google account where you want to set up your Google Workspace credentials. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-xj6sfhyv.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 2. Navigate to **IAM & Admin** > **Service Accounts**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-k3qihtfy.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 3. In the **Service Accounts**, select **CREATE SERVICE ACCOUNT** > **Service Accounts**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-rz8nflrs.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 4. In “Create service account” page, perform the following steps: ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-q5lrdhug.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 1. Name your service account and select **CREATE AND CONTINUE**. 2. Grant your service account access to a project. 3. Select **Continue**. 4. Grant users access to your service account. 5. Select **DONE**. ### Getting Client ID and Private Key 1. In Credentials, navigate to your new service account name, and select your new service account name. 2. In the “Service account details” page for your new service account, perform the following steps: 1. Navigate to the Unique ID, and copy the contents of the **Unique ID**. 2. This is also your **Client ID**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-wpbhds5s.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 3. Navigate to the **KEYS** tab. 4. Select **ADD KEY** > **Create new key**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-5ipul6yv.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 5. Select the **JSON** key type and click **CREATE**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-hpli4a5o.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 6. Save the key type as JSON file to your selected directory. Below is the sample private key. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-ahiqvl83.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) > [!NOTE] > **Note:** > > Your new public/private key pair is generated and downloaded to your machine, and it serves as the only copy of this key. Please/Kindly store it in a secure place. ### Setting Up Domain Wide Delegation 1. Navigate to **admin.google.com**. 2. Log in to your administrator Google account. 3. On the Google Admin Home Page, navigate to **Security** > **Access and data control** > **API controls**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-2wdjkhv5.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 4. In “API Controls” page, navigate to **Domain wide delegation**, and select **MANAGE DOMAIN WIDE DELEGATION**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-klojzag7.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 5. In “Domain-wide Delegation” page, select **Add new** to add a new client ID. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-jjgv88p0.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 6. In the “Add a new client ID” window, perform the following steps: ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-ihp1f391.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 1. In the ‘Client ID’ field, paste the [Unique ID](/docs/google-cloud-identity#ClientID) that you copied from the Service account details page. 2. In the ‘OAuth scopes (comma-delimited)’ field, add the following read-only scope to fetch users, deleted users, roles, and mobile devices data: 1. https://www.googleapis.com/auth/cloud-identity.devices.readonly 3. Select **AUTHORIZE**. ## DataBee Configuration 1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-eruy1rf6.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 2. Search for the **Google Cloud Identity** option using the search bar in the “Add new data feed” page. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-97ousbsc.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 3. Click on the **API Ingest** option for the collection method. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-qjri4k8q.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-xvt9qugu.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) 5. In the configuration details dialog, enter the following: ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/google-cloud-identity-mar2025-image-jisdr7f5.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A32%3A38Z&se=2026-10-30T12%3A32%3A38Z&sr=c&sp=r&sig=gFgkUjQji6hfG9fseUdLJgiDROjXI3XrwGQ5HcaZ%2BWk%3D) - Authorization Method: Google OAuth2 - API Base URL: replace the placeholder with value based on the location of your GCP account as listed below. - global: *securitycenter* - me-central-2: *securitycenter.me-central2.rep* - Token URL: enter https://oauth2.googleapis.com/token. - Private Key: paste the private key inside the Service Account JSON file downloaded earlier. - Client Email: enter the email address during the service account creation process Example: - Correct Format: MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAA - Incorrect Format: -----BEGIN PRIVATE KEY----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAA\n-----END PRIVATE KEY-----\n - Admin Email: enter the email address of the user for which the application is requesting delegated access. If there is no [domain-wide authority delegated](https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority) to the service account, enter the same email as entered in the Client Email field. 6. Click **Submit**. ## Troubleshooting Tips - If you’re facing **invalid_client** or **unauthorized_client** issues, this might be due to incorrect service account credentials. Ensure the private key is pasted correctly. Since you cannot view the key after the first time, re-create the service account key, paste it into a text editor to verify there are no spaces or unexpected characters, and reconfigure the Google Cloud Identity integration. - If you are facing a response code **403**, this might be due to missing permissions. Ensure that the service account has the required Cloud Identity roles and permissions as per the steps mentioned above.