Google Workspace Integration

Get a complete view of your organization
Automatically sync all users, domains, and organizational units from Google Workspace. No manual uploads required.
Track app usage with Google SSO
See which third-party apps employees are using with their corporate accounts and when they last accessed them. This helps identify redundant or risky tools.
Manage costs more effectively
Spot unused or duplicate licenses across apps and reallocate them, reducing SaaS spend.
Maintain data accuracy
User and app data is updated daily, so your dashboards always reflect the latest state of your organization.
Ensure secure access
By connecting only through an Admin account with read-only scopes, Spendbase can provide visibility without making changes to your Google Workspace.

A unified list of users with names, emails, and avatars
Full visibility into apps: which services are accessed via Google SSO and when they were last used
Organizational structure with each user mapped to their unit

Automatic data updates without manual exports

Spendbase connects to Google Workspace in a read-only mode.

No changes made to your Google Workspace account
Data is used only for visibility and SaaS cost optimization
The initial data import may take up to 30 minutes, depending on the amount of data
After the initial sync, data is automatically refreshed once per day

Note: This flow will work, only if you've enabled the API access or whitelist Spendbase

To enable API access:

sign in to the Google Admin console with a super admin account: admin.google.com.
From the Admin console Home page, go to Security -> Access and data control -> Api Access .
Under App access control, make sure Enable API access is turned ON.
Save your changes.

To whitelist Spendbase:

Sign in to the Google Admin console (https://admin.google.com): You'll need an administrator account.
Navigate to API Controls: Go to Menu > Security > Access and data control > API controls.
Manage Third-Party App Access: Click on Manage third-party app access.
Find the App: Search for the app that's blocked, either by name or by its Client ID.
Change Access: Click "Change access" next to the app.
1. Select Access Level: Choose from the following options (we recommend "Trusted")
  1. Trusted: Allows the app to access all Google services.
  2. Specific Google data: Allows the app to access only the data specified by the OAuth scopes.
  3. Limited: Allows the app to access only unrestricted Google data.
  4. Blocked: Prevents the app from accessing Google data.

Review the scope and access settings, then click "Change access". Use ‘Spendbase’ freely with no ‘This app is blocked’ warning

Scope	Description	Why does Spendbase need it
/auth/admin.directory.domain.readonly	View domains related to your customers	To identify and confirm which domains belong to the organization
/auth/admin.directory.user	View and manage the provisioning of users on your domain	To sync the full list of users and keep the Spendbase directory up-to-date
/auth/admin.directory.user.alias.readonly	View user aliases on your domain	To map alias addresses to the correct primary user
/auth/admin.directory.orgunit.readonly	View organization units on your domain	To assign each user to the correct organizational unit
/auth/admin.directory.customer.readonly	View customer-related information	To identify the organization in Google Workspace and enable tenant-level mapping
/auth/admin.reports.audit.readonly	View audit reports for your G Suite domain	To detect which third-party apps users sign into with Google SSO, and their last activity

How to verify the sync?

The widget status will show:

If you run into issues, our support team is here to help: