Google Workspace Directory connector

Use your Google Workspace Directory data for reporting, automation and AI.

Data Panda pulls your Google Workspace users, groups, organisational units and managed devices into the same warehouse as the rest of your business. From one place we turn it into dashboards, automations, AI workflows and custom apps that IT, finance and HR use during the month, not only the week of an access review.

About Google Workspace Directory

The directory layer of Google Workspace, the identity-of-record for a Google shop.

Google Workspace is Google's productivity and collaboration suite for business: Gmail, Calendar, Drive, Docs, Meet, Chat and the rest of the editor stack, with the Admin console at admin.google.com on top. Google's own announcement in January 2025 puts the install base at more than 10 million paying businesses across the Business Starter, Business Standard, Business Plus and Enterprise editions, plus the Cloud Identity tiers that share the same directory.

Behind the productivity apps sits the directory: every Workspace tenant has a single record of users, groups, organisational units, role assignments, custom user-attribute schemas and managed devices (mobile, ChromeOS and Chrome browsers), reachable through the Admin SDK Directory API. That directory is what HR-driven joiner-mover-leaver flows write to, what SAML and SCIM-based SSO handshakes for downstream SaaS read from, and what your endpoint-management posture is anchored on. Pulled into a warehouse next to the HRIS, the SaaS catalogue and the finance ledger, the Workspace Directory finally answers the questions that the Admin console alone does not: time from a BambooHR or HiBob leaver record to the matching Workspace user being suspended, dormant accounts still holding a Business Plus seat, drift between the org-unit tree and the cost-centre tree, or where 2-step verification skips concentrate by org unit.

What your Google Workspace Directory data is for

What you get once Google Workspace Directory is connected.

Identity, device and licence reporting

Users, groups, org units, devices and 2-step verification coverage on one page, joined to HR and SaaS-spend data.

Active versus dormant accounts per edition (Business Starter, Standard, Plus, Enterprise) and per org unit
2-step verification enrolment per group and per org unit, with policy carve-outs called out
Leaver-to-suspension lag from HR offboarding to Workspace account suspension

Lifecycle and access automation

Let HR events and Workspace signals drive the right account work, instead of an IT ticket queue rebuilt every Monday.

Provision a Workspace user with the right group memberships the day a new hire signs in HiBob
Suspend the Workspace account within hours of a leaver record and free the licence
Move users between org units when their cost-centre changes, so the right policy and licence apply

AI workflows

Put the directory and device record behind AI that sees actual usage, not the org chart from last quarter.

Recommend group memberships based on peers in the same role and org unit
Risk-flag managed devices that have not synced in N days against their assigned user
Natural-language Q&A across users, groups, org units and licence assignments for IT and audit

Custom apps on your data

Lightweight tools on Workspace data for managers and BU heads who should not need an Admin-console seat to read their own team.

Manager workbench with team users, group memberships, 2SV coverage and assigned licences
App-owner dashboard with active users, dormant share and licence cost per edition
Joiner-mover-leaver tracker with the gap from HR action to Workspace change visible per case

Use cases

Use cases we deliver with Google Workspace Directory data.

A list of concrete reports, automations and AI features we have built on Google Workspace Directory data. Pick the one that matches your situation.

Dormant-account auditWorkspace accounts inactive past 30, 60 or 90 days, per edition and per org unit, with the licence cost per seat attached.

2-step verification coverageEnrolment per org unit and per group, with the carve-outs (service accounts, legacy clients) called out.

Leaver-to-suspension lagHours between a HiBob or BambooHR termination record and the Workspace user being suspended.

Org-unit drift versus cost centreWhere the Workspace org-unit tree no longer lines up with the finance cost-centre tree, per user.

Licence mix per org unitBusiness Starter, Standard, Plus and Enterprise distribution per org unit and per cost centre.

Group membership growthNew group memberships per quarter and per org unit, ranked by the SaaS apps each group provisions.

Privileged role assignment reviewSuper-admin, group-admin and delegated-admin role assignments against approved scope and approver.

Managed device inventoryChromeOS, mobile and Chrome-browser devices per assigned user, with last-sync gap and policy state.

Joiner provisioning timingTime from new-hire start date in HiBob to a fully provisioned Workspace user, per role family and team.

Custom-attribute completenessCoverage of custom user-attribute schemas (employee number, cost centre, country) per org unit.

Real business questions

Answers you will finally get.

Which paid Workspace seats are sitting on dormant accounts?

Account activity per user, joined to the assigned Workspace edition (Business Starter, Standard, Plus, Enterprise) and the cost per seat, so finance and IT see exactly which Plus or Enterprise licences sit unused past 60 or 90 days. Reclaiming or downgrading those seats becomes a list of names and org units rather than a quarterly back-and-forth with the licence reseller.

How long does it really take to suspend a leaver in Workspace?

The lag in hours between a termination record in your HRIS and the matching Workspace account being suspended, plus the per-app deprovisioning time after that for SaaS provisioned through Workspace SSO. HR and security see the cases that drift past policy, instead of trusting that the lifecycle automation fired on time.

Where does 2-step verification get skipped in practice?

Enrolment per org unit, per group and per role assignment, with the policy carve-outs (service accounts, legacy clients, exec exceptions) named. The security team sees which exceptions account for most of the unprotected accounts, and which can be retired without breaking a workflow.

Value for everyone in the organisation

Where each function gets value.

For finance leaders

Workspace licence spend reconciled against actual identity-level activity per edition. You see which Business Plus or Enterprise contracts can be downgraded at renewal because the seats sit on dormant accounts, instead of taking the per-seat number on the invoice at face value.

For sales leaders

Group and org-unit hygiene for the customer-facing stack that is provisioned through Workspace SSO. Sales ops sees which reps still sit in groups for territories they no longer cover, and which leavers were never removed from shared mailing lists.

For operations

Joiner-mover-leaver in one operational view. IT sees the gap between an HR action in HiBob or BambooHR and the matching Workspace change per case, instead of trusting that the lifecycle automation fired and reading about exceptions in next month's audit.

Ideas

What you can automate with Google Workspace Directory.

Pair with HiBob

Drive Workspace joiners and leavers from HiBob

New hires in Bob trigger the matching Workspace user, the right org unit, group memberships and licence (Business Starter, Standard, Plus or Enterprise) on the start date, with 2-step verification enforced from day one. Termination records suspend the account within hours and free the licence, so the lag from HR action to Workspace change is a number you can report rather than a hope. The case-by-case timing lands in the warehouse next to the audit trail.

Pair with Salesforce

Keep Salesforce profiles in step with Workspace groups

Group changes in Workspace that drive Salesforce profile, role and permission-set assignment land on the matching Salesforce user the same day, with the previous state kept in the warehouse for audit. Sales ops stops reconciling territories by hand at quarter-end, and a leaver loses the Salesforce seat the moment Workspace suspends the account rather than at the next manual cleanup.

Pair with Slack

Sync Slack workspace membership with Google groups

Workspace group memberships drive Slack workspace and channel membership, so a new hire lands in the right project channels on day one and a leaver loses Slack access the moment the Workspace account is suspended. Privileged-role changes and unexpected admin grants in Workspace post a compact alert in the IT-ops or security Slack channel, with user, org unit and recent activity attached. The team triages where they already watch instead of opening the Admin console per case.

Pair with monday.com

Mirror Workspace org units into monday.com teams

Org-unit and group changes in Workspace flow into monday.com team and board membership, so project boards reflect the current org without a board owner chasing managers per move. New hires in HiBob land on the right monday.com boards through their Workspace org unit, and leavers fall off the same day they are suspended in Workspace. The audit trail of who got added to which board, when and why is in the warehouse rather than in monday.com activity logs alone.

Pair with Exact Online

Re-allocate Workspace licence cost per cost centre in Exact Online

Workspace org-unit assignments drive the cost-centre allocation of monthly Workspace licence spend in Exact Online, so a finance controller sees the per-cost-centre Business Starter, Standard, Plus and Enterprise total without rebuilding the split from a CSV export each month. Movers between org units re-allocate from the next billing cycle, and the previous allocation stays in the warehouse for variance analysis.

Pair with HubSpot

Keep HubSpot users and teams aligned with Workspace

Workspace org-unit and group changes propagate to HubSpot user, team and ownership rotation, so a new account manager inherits the right HubSpot pipeline on day one and a leaver releases their HubSpot seat the moment Workspace suspends them. Sales ops stops cleaning HubSpot user lists at quarter-end, and the lag between a HiBob change and the matching HubSpot change is visible per case.

Your existing tools

Your data lands in a warehouse. Your BI tools read from it.

You keep the reporting tool you already have. We connect it to the warehouse where your Google Workspace Directory data lives.

Power BI Microsoft

Fabric Microsoft

Snowflake Data warehouse

BigQuery Google

Tableau Visualisation

Excel Sheets & pivots

Three steps

From Google Workspace Directory to answers in three steps.

Connect securely

OAuth authentication. Read-only by default. We sign a DPA and your admin keeps the keys.

Land in your warehouse

Data flows into your warehouse on your schedule. Near real time or nightly, your call. You own the data.

Reporting, automation, AI

We build the first dashboard, workflow or AI feature with you, then hand over the keys. Or we stay on for ongoing delivery.

Two ways to work with us

Pick the track that fits how you work.

Track 01

Self-serve

We set up the foundation. Your team builds on top.

Google Workspace Directory connector configured and running
Warehouse set up in your cloud account
Clean access for your Power BI, Fabric or Tableau team
Documentation on what's in the data model
Sync monitoring so you're warned before reports break

Best fit Teams that already have a BI analyst or data engineer and want to own the build.

Track 02

Done for you

We build the whole thing, end to end.

Everything in Self-serve
Dashboards built to the questions your team actually asks
Automations between your systems
AI workflows scoped to real tasks your team runs
Custom apps where a dashboard does not cut it
Ongoing delivery at a pace that fits your team

Best fit Teams without in-house BI or dev capacity. You tell us what you need and we deliver it.

Before you book

Frequently asked questions.

Who owns the data?

You do. It lands in your warehouse, on your cloud account. We don't resell or aggregate it. If you stop working with us, the warehouse stays yours and keeps running.

How fresh is the data?

Near real time for most operational systems. For heavier sources we schedule hourly or nightly. You pick based on what the reports need.

Do I need a warehouse already?

No. If you don't have one, we help you pick one and set it up as part of the first delivery. Common starting points are Snowflake, Microsoft Fabric, or a small Postgres start.

Does the connector cover Cloud Identity users too, or only paid Workspace seats?

Both. The Workspace Directory and Cloud Identity (Free and Premium) sit on the same admin.google.com tenant and the same Admin SDK Directory API. We pull users, groups, org units and devices regardless of which licence each user holds, and we keep the assigned-edition column on the user record so you can split a report between paid Workspace seats and Cloud Identity-only accounts whenever it matters for licence spend or policy.

Will the sync run into the Admin SDK rate limits?

The Admin SDK Directory API enforces a default per-user, per-project quota of 2,400 queries per minute, with separate concurrent caps on user-creation, mobile-device and org-unit operations. We use incremental extraction (since-token style on users and groups), paginate at the documented maxima (500 users, 200 group members and 100 device entries per page) and back off on 429 responses, so a tenant with tens of thousands of users keeps syncing without burning through the quota that your in-product Workspace integrations also depend on.

Does this include managed device data (ChromeOS, mobile, Chrome browsers)?

Yes, scoped to what the Admin SDK Directory API exposes: ChromeOS device inventory and last-sync state, mobile devices enrolled through Google endpoint management, and Chrome browser enrolment for tenants on Chrome Browser Cloud Management. Detailed per-app browser telemetry that is not in the Directory API stays out of scope by design, and we agree the device-event retention horizon per use case rather than holding everything indefinitely.

GDPR-compliant

Data stays in the EU

You own the warehouse

A first deliverable live in four to six weeks.

We review your Google Workspace Directory setup and the systems around it. Together we pick the first thing worth building.

Book a call See our other connectors