Google Workspace Admin

Google Workspace Admin

This connector manages a Google Workspace (or Cloud Identity) account through the Admin SDK: the Directory API (https://admin.googleapis.com/admin/directory/v1: users, aliases, groups and members, organizational units, admin roles and role assignments, ChromeOS and mobile devices, domains) and the Reports API (/admin/reports/v1: audit logs and usage statistics). It always works on the account of the Google user who authorizes it (my_customer).

Who can use it: the authorizing Google account must be a Workspace administrator. A Super Admin can use every tool. A delegated admin works for the parts their role covers, as long as the role also has the matching Admin API privileges (Admin console → Account → Admin roles → the role → Privileges → Admin API): Users (read, create, update) for user and alias tools, Groups for group and member tools, Organization Units for org unit tools, Reports for the audit and usage tools, Services → Chrome OS and Mobile Device Management for devices, Domain Settings for domains. Roles and role assignments need Super Admin or the Admin API privilege Roles Management. A regular user gets 403 Not Authorized to access this resource/api on every call. Use a dedicated admin account with the smallest role that covers the work.

Setup (one-time, about 10 minutes)

1. Open https://console.cloud.google.com, pick or create a project, then APIs & Services → Library → enable Admin SDK API (it covers Directory and Reports).
2. APIs & Services → OAuth consent screen: choose Internal (the project must belong to the same Google Workspace organization; simplest). For External, set the publishing status to In production: while an app is in Testing, Google revokes its refresh tokens after 7 days and the connector stops working every week.
3. APIs & Services → Credentials → Create credentials → OAuth client ID → application type Web application → add the authorized redirect URI <your AnythingMCP URL>/api/mcp-oauth/callback (on AnythingMCP Cloud: https://cloud.anythingmcp.com/api/mcp-oauth/callback).
4. Paste the client ID and secret into GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET and install the connector.
5. On the connector page, click Authorize with Provider and sign in with the admin account. The refresh token is stored encrypted and access tokens are renewed automatically.
6. If the Admin console restricts third-party apps (Security → Access and data control → API controls), mark this OAuth client as Trusted, otherwise sign-in ends with admin_policy_enforced.

One Google client for all Google connectors: the same Cloud project and OAuth client can serve every Google connector (Gmail, Google Calendar, Google Drive, Google Sheets, Search Console, Analytics, Ads, Admin). Enable each API in that project, reuse the same GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET, and authorize each connector once: each one asks only for its own scopes.

Scopes: admin.directory.user, admin.directory.user.security (sign out), admin.directory.group (groups and members), admin.directory.orgunit, admin.directory.rolemanagement, read-only scopes for ChromeOS devices, mobile devices, domains and the customer, and admin.reports.audit.readonly plus admin.reports.usage.readonly. For a read-only setup, replace the first five with their .readonly variants (admin.directory.user.readonly, admin.directory.group.readonly, admin.directory.orgunit.readonly, admin.directory.rolemanagement.readonly) and drop admin.directory.user.security in the connector's OAuth settings, authorize again, and disable every create, update, add, assign, suspend, sign-out and undelete tool.

Switched off at install: google_admin_delete_user, google_admin_delete_group, google_admin_remove_group_member, google_admin_delete_user_alias and google_admin_delete_role_assignment; they cannot be undone (a deleted user can only be restored for 20 days, a group never), so an admin switches them on when the team needs them.

Start here: google_admin_get_customer checks the connection and shows the customer id and primary domain; google_admin_list_domains and google_admin_get_domain list the domains, google_admin_list_domain_aliases the alias domains.

Users

• Find: google_admin_list_users with query (e.g. isSuspended=true, orgUnitPath='/Sales', isEnrolledIn2Sv=false, isAdmin=true, email:anna*), then google_admin_get_user for one person. user_key accepts the primary email, an alias or the immutable id.
• Onboard: google_admin_create_user (initial password, change_password_at_next_login true), then google_admin_add_group_member and google_admin_update_user for title, department, manager or org unit. Extra addresses with google_admin_add_user_alias; list them with google_admin_list_user_aliases.
• Offboard or incident: google_admin_suspend_user (reversible with google_admin_unsuspend_user) and google_admin_sign_out_user to end all sessions; set a new password with google_admin_update_user. Deleting (google_admin_delete_user) loses mail and files unless they were transferred first in the Admin console; google_admin_undelete_user restores within 20 days by user id.
• google_admin_update_user only changes the fields you send; lists (organizations, phones, relations) replace the whole list.

Groups: google_admin_list_groups (search with query, e.g. email:sales*), google_admin_list_user_groups for one user's groups, google_admin_get_group, google_admin_create_group, google_admin_update_group, google_admin_delete_group. Members: google_admin_list_group_members (with include_derived_membership for nested groups), google_admin_get_group_member, google_admin_has_group_member (direct or nested, users only), google_admin_add_group_member, google_admin_update_group_member (role, delivery), google_admin_remove_group_member.

Organizational units: google_admin_list_org_units (type "all" for the whole tree), google_admin_get_org_unit, google_admin_create_org_unit, google_admin_update_org_unit. In tool paths an org unit is written without the leading slash (Sales/EMEA) or as id:<orgUnitId>; in user fields (org_unit_path, parent_org_unit_path) with it (/Sales/EMEA). Moving users is done on the user with google_admin_update_user.

Admin roles: google_admin_list_roles and google_admin_get_role show roles and privileges; google_admin_list_role_assignments shows who is an admin (filter by user_key or role_id; assignedTo is a user or group id, resolve it with google_admin_get_user or google_admin_get_group); google_admin_get_role_assignment reads one. google_admin_assign_role grants a role (needs the immutable user or group id and scope_type); google_admin_delete_role_assignment takes it away. A quick list of super admins: google_admin_list_users with query isAdmin=true.

Devices (read-only): google_admin_list_chromeos_devices and google_admin_get_chromeos_device (by deviceId); google_admin_list_mobile_devices and google_admin_get_mobile_device (by resourceId). Search syntax: status:provisioned, user:[email protected], sync:..2026-06-01 (not synced since). Blocking or wiping devices stays in the Admin console.

Reports

• Audit logs: google_admin_list_activities with application_name (login, admin, drive, token, groups, mobile, meet, gmail, calendar, chrome, saml, user_accounts...) and user_key all or one user. Narrow with start_time/end_time (RFC 3339, UTC) and event_name, e.g. login_failure or suspicious_login on login, download on drive, authorize on token. Results are newest first; most logs go back about 6 months (Drive and some others longer on higher editions). Events take minutes to hours to appear.
• Usage: google_admin_get_customer_usage (account totals for one day) and google_admin_get_user_usage (per user, user_key all). date is YYYY-MM-DD in Pacific Time and data is 1-3 days late: a too recent date returns a warning such as PARTIAL_DATA_AVAILABLE or DATA_NOT_AVAILABLE; step back a day. Select values with parameters (accounts:last_login_time, accounts:used_quota_in_mb, gmail:num_emails_sent, accounts:is_2sv_enrolled) and filter users with filters (accounts:last_login_time<2026-07-01T00:00:00.000Z).

Reading the answers: times are RFC 3339 in UTC (lastLoginTime 1970-01-01T00:00:00.000Z means never signed in); domain creationTime is epoch milliseconds. Ids (id, orgUnitId, roleId, roleAssignmentId, deviceId, resourceId) are stable; emails can change.

Paging: list tools return nextPageToken; call again with page_token until it is missing. Page sizes: users 500, groups and members 200, ChromeOS 300, mobile 100, activities and user usage 1,000.

Limits and errors

• Quota: Google limits queries per minute per project and per user; 403 quotaExceeded, rateLimitExceeded or 429 means wait a minute and retry, and prefer one search over many single reads. Creating many users or groups at once can need a few minutes before they are visible.
• 401: authorization expired or was revoked (always after 7 days while the consent screen is in Testing): click Authorize with Provider again.
• 403 Not Authorized to access this resource/api: the signed-in account is not an admin, or its role lacks the Admin API privilege for this area. 403 Request had insufficient authentication scopes: authorize again after a scope change. 403 "Admin SDK API has not been used in project": enable the API (step 1).
• 404 Resource Not Found: userKey: no such user, alias or id. 409 Entity already exists: the email, alias or member is already taken. 400 Invalid Input: check the email domain belongs to the account and the password length.

Out of scope here: Gmail and Drive content (use the Gmail and Google Drive connectors), group settings (Groups Settings API), licenses (Enterprise License Manager API), device wipe or block, and data transfer at offboarding.