Overview
Purpose
The Google Workspace Integration enables organisations to securely connect their Google Workspace tenant with Montro.
Once connected, Montro automatically discovers and synchronises users, licenses, administrator roles, audit activities, OAuth grants, installed applications, and other supported Google Workspace resources into the Montro platform.
This integration provides organisations with centralised visibility into users, applications, subscriptions, and security insights.
Data synchronised through this integration is processed and stored within Montro’s EU-based infrastructure. For full details on Montro’s infrastructure, sub-processors, and data protection practices, see the Trust & Security page.
The integration supports both Read and Read and Take Action permission levels, allowing organisations to choose the appropriate level of access based on operational requirements.
STEP 1: Sign in to Montro
Go to app.montro.io and sign in to your Montro account using your administrator credentials.
Montro sign-in screen
STEP 2: Navigate to the Integrations Section
From the left navigation menu, select Integrations, then locate the Google Workspace integration.
Click Connect to begin the integration process.
Integrations section with Google Workspace connector
STEP 3: Select the Permission Level
After clicking Connect on the Google Workspace integration, the Connect Google Workspace side panel will appear.
Connect Google Workspace panel
The side panel allows you to select the appropriate permission level for the integration based on your organisation's requirements. Google Workspace supports the following permission levels:
Read
Grants Montro read-only access to your Google Workspace environment. This permission allows Montro to securely synchronise organisational data without making any changes to your Google Workspace tenant.
Read and Take Action
Grants Montro permission to synchronise data and perform supported administrative actions within your Google Workspace environment. Supported administrative actions include:
● Create Google Workspace users
● Assign licenses to existing users
● Remove assigned licenses
After selecting the required permission level, click Connect to continue. You will then be redirected to the Google authentication page to authorise the integration.
TECHNICAL DETAILS - OAuth Permission Model
Montro uses Google OAuth 2.0 to securely request access to your Google Workspace environment. The permissions requested depend on the permission level selected during the integration process.
Read Permission
When Read permission is selected, Montro requests the following Google OAuth scopes.
| OAuth Scope | Description |
| admin.directory.user.readonly | Allows Montro to synchronise Google Workspace users. |
| admin.reports.audit.readonly | Allows Montro to retrieve audit reports, including password change events. |
| admin.directory.customer.readonly | Allows Montro to retrieve Google Workspace customer information. |
| apps.licensing | Allows Montro to synchronise Google Workspace license information. |
| admin.directory.rolemanagement | Allows Montro to synchronise administrator roles and role assignments. |
| admin.directory.user.security | Allows Montro to retrieve user security information. |
Read and Take Action Permission
When Read and Take Action permission is selected, Montro requests the following Google OAuth scopes.
| OAuth Scope | Description |
| admin.directory.user | Allows Montro to create and manage Google Workspace users. |
| admin.reports.audit.readonly | Allows Montro to retrieve audit reports, including password change events. |
| admin.directory.customer.readonly | Allows Montro to retrieve Google Workspace customer information. |
| apps.licensing | Allows Montro to synchronise and manage Google Workspace licenses. |
| admin.directory.rolemanagement | Allows Montro to synchronise administrator roles and role assignments. |
| admin.directory.user.security | Allows Montro to retrieve user security information. |
Supported Administrative Actions
The following administrative actions are available only when Read and Take Action permission is granted.
| Action | Description |
| Create User | Creates a new Google Workspace user. |
| Assign License | Assigns a Google Workspace license to an existing user. |
| Remove License | Removes an assigned license from an existing user. |
Security Notes
- Montro requests only the minimum OAuth permissions required for the selected integration mode.
- Synchronised data is processed and stored within Montro’s EU-based infrastructure, in line with Montro’s data protection practice.
- Authentication is performed using Google's secure OAuth 2.0 authorisation framework.
- Google Workspace administrator credentials are never stored or processed by Montro.
- All communication between Montro and Google Workspace APIs is encrypted using HTTPS (TLS).
- Administrative actions are available only when Read and Take Action permission is explicitly authorised.
Technical Reference
For detailed information about Google OAuth scopes and their functionality, refer to the official Google OAuth documentation.
Google OAuth Scopes Reference: developers.google.com/identity/protocols/oauth2/scopes
STEP 4: Authenticate with Google Workspace
Google Sign-In page
After selecting the required permission level and clicking Connect, you will be redirected to the Google Sign-In page.
If you are not already signed in to your Google Workspace account, enter your administrator credentials to continue. If you are already signed in, select the appropriate Google Workspace Administrator account.
After successful authentication, Google displays the OAuth Consent screen listing the permissions requested by Montro.
Review the requested permissions and click Allow to authorise the integration.
Once authorisation is completed successfully, you will be redirected back to Montro, where the synchronisation process will begin automatically.
| NOTE: If your organisation restricts third-party application access in the Google Admin Console (Security → API Controls → App Access Control), a Google Workspace Super Administrator may need to pre-approve Montro before the OAuth consent screen will allow authorisation to proceed. If the consent screen does not display the expected permissions, check this setting first. |
| NOTE: You must authenticate using a Google Workspace Administrator account with sufficient permissions to authorise the requested access. |
Google OAuth consent screen
TECHNICAL DETAILS - Authentication Process
Montro uses Google OAuth 2.0 Authorisation Code Flow to securely authenticate and authorise access to your Google Workspace environment. The authentication process includes the following steps:
1. The administrator clicks Connect.
2. Google displays the Sign-In page.
3. The administrator authenticates using Google Workspace credentials.
4. Google displays the OAuth Consent screen.
5. The administrator reviews the requested permissions.
6. The administrator clicks Allow.
7. Google issues an authorisation code.
8. Montro securely exchanges the authorisation code for OAuth access tokens.
9. The integration is established and synchronisation begins automatically.
Security Notes
- Authentication is performed entirely by Google.
- Google Workspace administrator passwords are never shared with or stored by Montro.
- OAuth access is limited to the permissions approved during authorisation.
- All communication between Montro and Google Workspace services is encrypted using HTTPS (TLS).
STEP 5: Verify Synchronisation
After successfully authorising the Google Workspace integration, Montro automatically starts the synchronisation process.
Once the connection is established, a Successfully Synced confirmation pop-up is displayed, indicating that the integration has been completed successfully.
Successfully Synced confirmation
The synchronisation summary displays the following information:
- Integration Status - Displays the current synchronisation status.
- Connected On - Displays the date and time when the integration was established.
- Permission Level - Displays the permission level granted during the integration.
- Resources Synchronised - Displays the synchronisation status of supported Google Workspace resources.
Once all resources display Successfully Synced, the Google Workspace integration has been completed successfully.
| NOTE: The initial synchronisation time depends on the size of your Google Workspace environment. Larger organisations may require additional time to complete the synchronisation process. |
TECHNICAL DETAILS - Synchronisation Process
After successful authorisation, Montro automatically begins synchronising supported resources from your Google Workspace environment. The synchronisation process retrieves organisational data using the approved OAuth permissions and securely imports it into the Montro platform.
The synchronised data is used across multiple Montro modules, including:
- Discovery
- Users
- Spend Management
- Governance
- Security Insights
- Reporting
Resources Synchronised
The following Google Workspace resources are synchronised during the integration process.
| Resource | Description |
| Users | Synchronises user accounts and profile information. |
| Licenses | Imports assigned Google Workspace licenses. |
| Administrator Roles | Imports administrator roles configured in Google Workspace. |
| Role Assignments | Synchronises role assignments associated with administrator accounts. |
| Installed Applications | Discovers installed applications using Google Workspace audit logs. |
| OAuth Grants | Synchronises OAuth grants approved by users. |
| OAuth Scopes | Synchronises OAuth scopes associated with authorised applications. |
Security Notes
- Synchronisation is performed only after successful OAuth authorisation.
- Montro synchronises only the resources permitted by the approved OAuth scopes.
- All communication between Montro and Google Workspace APIs is secured using HTTPS (TLS).
- Google Workspace passwords and authentication credentials are never stored or processed by Montro.
STEP 6: View Imported Applications
Once the Google Workspace integration has been successfully connected and the initial synchronisation is complete, the imported applications can be viewed in the Applications section of Montro.
Navigation: Discovery → All Apps
All Apps: imported applications
The All Apps page provides a centralised inventory of applications discovered from your connected Google Workspace environment. Each application is automatically synchronised and enriched with relevant metadata to provide better visibility into application usage across your organisation.
The Applications page includes information such as:
- Application Name
- Category
- Number of Accounts
- MFA Status
- External Users
- Source
- Additional Application Details
| NOTE: The applications displayed reflect user activity available within your connected Google Workspace environment. Newly discovered applications will appear after the next successful synchronisation cycle. |
STEP 7: View Imported Subscriptions
After the Google Workspace integration has been successfully connected and the synchronisation process is complete, the imported subscriptions can be viewed in the Subscriptions section of Montro.
Navigation: Spend → Subscriptions
Subscriptions page
The Subscriptions page provides a centralised view of all subscription plans imported from your connected Google Workspace environment. This information helps administrators monitor subscription inventory, license availability, renewal details, and subscription usage from a single location.
Each subscription record includes information such as:
- Subscription Name
- Associated Application
- Pricing
- Renewal Date
- Subscription Status
- Total Licenses
- Subscription Cost (if available)
| NOTE: The subscriptions displayed are synchronised directly from your connected Google Workspace tenant. The available subscription information may vary depending on your Google Workspace edition, purchased subscriptions, and licensing configuration. |
STEP 8: View Imported Licenses
After the Google Workspace integration has been successfully connected and the synchronisation process is complete, the imported licenses can be viewed in the License section of Montro.
Navigation: Spend → Subscriptions → License
License page
The License page provides a centralised view of all license assignments synchronised from your connected Google Workspace environment. This allows administrators to monitor license allocation, assigned users, subscription mapping, and license utilisation from a single location.
Each license record includes information such as:
- Master Application
- User Name
- License Status
- Subscription Name
- User Email Address
- Last Active On
| NOTE: The displayed license information is synchronised directly from your connected Google Workspace tenant. The number of available licenses and assigned users depends on your organisation's licensing configuration. |
STEP 9: View Imported Users
After the Google Workspace integration has been successfully connected and the synchronisation process is complete, the imported users can be viewed in the Users section of Montro.
Navigation: Users → Employees
Employees: imported users
STEP 10 Disconnect the Integration
If you need to disable the Google Workspace integration, go to Integrations, locate the Google Workspace connector, and select Disconnect.
Navigation: Integrations → Google Workspace → Disconnect
Once disconnected, Montro stops synchronising data from your Google Workspace tenant, and no further administrative actions can be performed until the integration is reconnected.
| NOTE: Data previously synchronised into Montro remains visible after the integration is disconnected. It will not be updated further until the integration is reconnected. |
Frequently Asked Questions (FAQ)
This section provides answers to the most commonly asked questions about the Google Workspace integration.
Q1. Who can configure the Google Workspace integration?
The integration should be configured using a Google Workspace Administrator account. A Super Administrator account is recommended to ensure all required permissions can be granted during the authorisation process.
Q2. What permission levels are supported?
The Google Workspace integration supports the following permission levels:
○ Read — Synchronises Google Workspace data into Montro without making any changes to your Google Workspace tenant.
○ Read and Take Action — Includes all Read capabilities and enables supported administrative actions, such as creating users and managing license assignments.
Q3. What data is synchronised from Google Workspace?
Depending on the granted permission level, Montro synchronises the following resources:
○ Users
○ Licenses
○ Password Change Audit Logs
○ Administrator Roles
○ Role Assignments
○ Installed Applications
○ OAuth Grants
○ OAuth Scopes
Q4. Does Montro store my Google Workspace password?
No. Montro uses Google OAuth 2.0 for authentication. Your Google Workspace credentials are verified directly by Google, and your password is never shared with or stored by Montro.
Q5. How long does the initial synchronisation take?
The duration of the initial synchronisation depends on the size of your Google Workspace environment. Organisations with a larger number of users, applications, and licenses may require additional time to complete the synchronisation process.
Q6. When will newly added users or applications appear in Montro?
Newly created users, applications, and license updates are synchronised during the next successful synchronisation cycle.
Q7. Can I change the permission level after the integration is connected?
Yes. If your organisation's requirements change, you can reconnect the integration and authorise it using a different permission level.
Q8. What administrative actions are available in Read and Take Action mode?
When Read and Take Action permission is granted, Montro supports the following administrative actions:
○ Create Google Workspace users
○ Assign licenses to users
○ Remove assigned licenses
Q9. What happens if I deny the requested permissions?
If the required OAuth permissions are not granted, the integration cannot be completed and Google Workspace data will not be synchronised into Montro.
Q10. Which Google services are used during the integration?
Montro communicates with the following Google services:
○ Google OAuth 2.0
○ Google Admin SDK Directory API
○ Google Licensing API
○ Google Reports API
Q11. Is communication between Montro and Google Workspace secure?
Yes. All communication between Montro and Google Workspace is encrypted using HTTPS (TLS). OAuth 2.0 is used to securely authenticate and authorise access.
Q12. Can I disconnect the integration?
Yes. The integration can be disconnected at any time from the Integrations section. Once disconnected, Montro will no longer synchronise data until the integration is reconnected.
Q13. Why are some users, applications, or licenses not visible after the integration?
If some resources are not immediately visible:
○ Wait for the initial synchronisation to complete.
○ Verify that the required OAuth permissions were granted.
○ Ensure the administrator account has access to the required Google Workspace resources.
○ Retry synchronisation if necessary.
Q14. Does Montro make changes to Google Workspace when Read permission is selected?
No. When Read permission is selected, Montro only retrieves and synchronises data. No modifications are made to your Google Workspace environment.
Q15. Where can I view the synchronised data after the integration is completed?
After synchronisation is complete, the imported data can be viewed in the following sections:
○ Discovery → All Apps — Imported applications
○ Spend → Subscriptions — Imported subscriptions
○ Spend → Subscriptions → License — Imported license information
○ Users → Employees — Imported user accounts