Directory & Identity

Google Workspace

Run Google Workspace user, group, and org-unit operations in natural language.

Dex connects to the Google Admin Directory API via a service account with domain-wide delegation and lets admins and employees manage Workspace users, groups, org units, calendar resources, and devices from plain-language requests — with full policy enforcement and audit trails.

Book a Demo

What Dex does with Google Workspace

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (CoAdmin)

Create, update, suspend, unsuspend, and delete Google Workspace users
Reset user passwords with forceChangePasswordAtNextLogin
Search users by name and filter by domain, department, or org unit
Create, update, and delete Google Groups (including org-wide groups)
Add, remove, and update member roles in groups (MEMBER, MANAGER, OWNER)
Create and manage organizational units and move users between OUs
Promote users to super-admin and manage custom admin roles and role assignments
Manage calendar resources (rooms, equipment) for the tenant
Manage mobile devices and Chrome OS devices enrolled in the tenant

For employees (self-service)

Reset your own Google Workspace password
Request to join a Google Group
View your own profile, groups, and OU
Update your own basic profile fields (phone, title)

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>Suspend gary@acme.com, remove him from all groups, and transfer his Drive files to his manager
>Create a user for priya.sharma@acme.com in the /Engineering OU with manager "david@acme.com"
>Add everyone in the "new-hires-q2" sheet to the "all-engineering@acme.com" and "eng-announce@acme.com" groups as MEMBER
>List all Google Groups with more than 50 members and show who the OWNERs are
>Move every user in the Marketing department to the /Marketing org unit
>Reset the password for sarah@acme.com and force change at next login

Employee prompts

>Reset my Google Workspace password
>Request access to the "product-team@acme.com" Google Group
>Show me every Google Group I'm a member of
>Update my title to "Senior PM" in my Workspace profile

Policy actions

Every action Dex can take on Google Workspace is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`password_reset`	Reset a Google Workspace user password	approvalself-only
`user_suspend`	Suspend or unsuspend a user (excludes privileged admins)	approval
`group_membership`	Add or remove members from a Google Group	approval
`google_create_user`	Create a new Google Workspace user account	approval
`google_update_user`	Update a user's profile fields (self-only by default)	self-only
`google_create_group`	Create a new Google Group	approval
`google_manage_org_unit`	Create, update, or move organizational units	approval

How to configure Google Workspace

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In Google Cloud Console, create (or reuse) a service account and download its JSON key file.
2
In the Google Workspace admin console, go to Security → Access and data control → API controls → Domain-wide delegation.
3
Click "Add new" and paste the service account's Client ID. Add these OAuth scopes: https://www.googleapis.com/auth/admin.directory.user, admin.directory.group, admin.directory.device.mobile, admin.directory.orgunit.
4
Enable the Admin SDK API in the Google Cloud project for the service account.
5
In Dex, enable the Google Workspace integration and paste the service account email, private key (PEM), a Super Admin email to impersonate, and your primary domain.
6
Dex validates the credentials with a GET /admin/directory/v1/users call impersonating the admin, then runs discovery to enumerate groups, OUs, admin roles, and calendar resources.

Vendor documentation ↗

Credentials required

serviceAccountEmail: Service account email (e.g., dex-sa@project-id.iam.gserviceaccount.com) from the Google Cloud JSON key
privateKey: Private key PEM from the service account JSON key file (starts with -----BEGIN PRIVATE KEY-----)
adminEmail: Google Workspace Super Admin email to impersonate for API calls (e.g., admin@company.com)
domain: Primary Google Workspace domain, e.g. company.com

Requirements

•Google Workspace Business Standard or higher (Admin SDK Directory API requires a paid plan)
•Super Admin account for initial service account authorization and domain-wide delegation setup
•Admin SDK API must be enabled in the Google Cloud project that owns the service account
•Domain-wide delegation authorizes the service account to impersonate any user in the domain — protect the private key
•Admin Directory API has a 2,400 requests/minute quota per project — Dex backs off on 429

Related integrations

See Dex run Google Workspace

Book a 30-minute walkthrough with our team and see how autonomous IT works in your environment — or get started for free.

Book a Demo Browse all integrations →