Stack Monitors

Monitor Google Workspace with Crowswatch

Monitor security alerts, sign-in activity, admin console changes, third-party app access and 2-Step Verification adoption across your Google Workspace domain directly from Crowswatch. Every scope granted is read-only — nothing in your Workspace is ever changed.

What This Integration Provides

Security Alerts: the Alert Center feed — phishing and malware reports, suspicious logins, account compromise, data loss prevention and Google-issued security warnings
Sign-in Activity: activity timeline, failed and suspicious sign-ins, verification challenges, and a searchable event log with IPs
SSO App Sign-ins: SAML single sign-ons per connected app, with failures and users
Third-party App Access: OAuth grants and revocations — which apps, how many users, which scopes
Drive Sharing & Exposure: sharing changes, public-link exposure, downloads and deletions from the Drive audit log
Gmail Traffic & Spam: domain-wide received / sent / spam volumes
Admin Console Changes and Group Changes: the full admin and Groups audit streams, filterable and searchable
Accounts & 2SV Adoption: total and suspended users, 2-Step Verification enrollment and enforcement
Mobile Device Events: registrations, compromised-device and suspicious-activity flags, failed passcodes
Meet Usage: participant sessions, call minutes and organisers

Every feed is served by the same three read-only scopes below — as Crowswatch adds Workspace feeds, no re-authorisation is ever needed.

Requirements

Requirement	Detail
Google Workspace edition	Any (Business Starter and above, including Education and Nonprofit)
Workspace super admin	Needed once, to authorise domain-wide delegation
Google Cloud project	Free — used only to create the service account
Estimated setup time	~15 minutes

Unlike most integrations, Google Workspace has no simple API key. Access works through a service account that your super admin explicitly authorises for specific read-only scopes. This is the same mechanism used by every major monitoring vendor.

Step 1: Create a Service Account

Go to console.cloud.google.com and sign in with your Workspace account
Create a new project (e.g. crowswatch-monitor) or pick an existing one
Open APIs & Services → Library and enable two APIs: Admin SDK API and Google Workspace Alert Center API
Open IAM & Admin → Service Accounts and click Create service account
Name it (e.g. crowswatch) and click Done — no project roles are needed
Open the new service account → Keys tab → Add key → Create new key → JSON
A .json key file downloads — you will paste its contents into Crowswatch in Step 3
Still on the service account's Details tab, copy the Unique ID (a long number, also called the client ID) — you need it in Step 2

Step 2: Authorise Domain-wide Delegation

A super admin must grant the service account read-only access in the Admin console:

Go to admin.google.com → Security → Access and data control → API controls
Under Domain-wide delegation, click Manage domain-wide delegation
Click Add new
Paste the service account's Unique ID from Step 1 as the Client ID
In OAuth scopes, paste all three scopes below, comma-separated
Click Authorise

Scope	Used for
https://www.googleapis.com/auth/apps.alerts	Security Alerts feed (Alert Center)
https://www.googleapis.com/auth/admin.reports.audit.readonly	Sign-in Activity, Admin Console Changes and Third-party App Access feeds
https://www.googleapis.com/auth/admin.reports.usage.readonly	Accounts & 2SV Adoption feed

All three scopes are read-only. You can grant a subset — feeds behind a scope you skip will show a precise “delegation not granted” message instead of data, and everything else keeps working.

Step 3: Add Credentials to Crowswatch

Navigate to: Crowswatch → Service API Integrations → Google Workspace

Field	Value
Service Account Key (JSON)	The full contents of the .json key file from Step 1 — open it in a text editor and paste everything
Admin email to impersonate	The email of an admin in your domain (Google requires service accounts to act on behalf of a real admin user)

When you click Connect, Crowswatch validates the key, the admin email and each granted scope with read-only test calls, and tells you exactly which step to fix if something is missing.

Available Metrics

Security

Alert Center security alerts with severity and source, filterable by severity
Sign-in activity timeline, failures, suspicious logins and a searchable event log with IPs
SAML SSO sign-ins per connected app with failure counts
OAuth grants and revocations to third-party apps, with users and scopes

Data & Email

Drive sharing changes, public-link exposure, downloads and deletions (needs an edition with Drive audit logs — Business Standard and up)
Gmail received / sent / spam volumes with spam rate

Administration

Admin console audit stream: who changed what, and when
Google Groups membership, role and setting changes
Account posture: users, suspended accounts, 2SV enrollment and enforcement

Devices & Collaboration

Mobile device registrations, compromised and suspicious-activity flags, failed passcodes (needs mobile management enabled)
Meet participant sessions, call minutes and organisers

Audit feeds (sign-ins, admin changes, app access) are near real-time. The Accounts & 2SVreport is published by Google 1–5 days behind — that lag is Google's, not Crowswatch's.

Security

The JSON key is encrypted with AES-256-GCM before storage and only ever decrypted server-side at fetch time
Every scope is read-only and every request Crowswatch makes is a GET
Create a dedicated service account for Crowswatch rather than reusing one from another system
To revoke access at any time, delete the domain-wide delegation entry in the Admin console or delete the service account key

Troubleshooting

"Domain-wide delegation has not been granted for the scope …"

The scope list in the Admin console (Step 2) is missing that scope. Edit the delegation entry for the client ID and make sure all three scopes are present, comma-separated, with no trailing spaces.

"Google rejected the impersonation"

The admin email does not exist in your domain, is suspended, or the key was deleted or rotated in Google Cloud. Check the email and, if needed, create a fresh JSON key.

"Access denied. Make sure the API … is enabled"

The Admin SDK API or the Google Workspace Alert Center API is not enabled in the service account's Google Cloud project (Step 1.3), or the impersonated user is not an administrator.

Accounts & 2SV shows no data

Google publishes usage reports 1–5 days behind, and brand-new domains can take longer. If other feeds work, credentials are fine — check back in a day or two.