Google Workspace Sync Overview

Google Workspace Sync

1. What it is

A Google Workspace connection keeps MangoApps in step with your Google domain. User sync brings in your people and keeps their details current. Group sync turns the Google groups you choose into employee groups, whose members follow Google.

• Enablement: a tenant admin adds the connection under Admin → Integrations → Manage Identity Providers. Only admins can see or change it.
• What it is not: it is not single sign-on. Signing in with Google is set up separately under the login methods. A Google Workspace connection syncs people and groups; it does not change how anyone signs in.

2. Standing it up

1. In the Google Cloud console, create a service account and download its JSON key. Turn on domain-wide delegation for it.
2. Go to Admin → Integrations → Manage Identity Providers, click Add Connection and choose Google Workspace.
3. Fill in Google Workspace Domain and Admin Email (for Domain-Wide Delegation), then paste the key into Service Account JSON.
4. Expand Scopes to grant in the Google Admin console and grant those scopes. Do this in the Google Admin console, under Security › API controls › Domain-wide delegation, using the service account’s client ID. There are three scopes, all read-only:
   • https://www.googleapis.com/auth/admin.directory.user.readonly — user sync
   • https://www.googleapis.com/auth/admin.directory.group.readonly — group sync
   • https://www.googleapis.com/auth/admin.directory.group.member.readonly — group sync
5. Save the connection, then click Test on its page. A passing test makes a new connection active (a connection an admin deactivated is switched back on with Activate Connection). The result also says whether group sync can work: “Group sync is available.” or “Group sync is not available yet: …”.
6. Run Sync → Full Sync once so your people are linked before any group is synced.
7. In the Groups card, click Choose groups and decide which Google groups become employee groups (see §3).

Group sync depends on two settings. Granting the group scopes in Google does nothing until you also choose groups here; choosing groups does nothing until the scopes are granted. User sync works without the group scopes, so you can roll out people first and groups later.

To confirm it worked, open the connection page:

• The Groups card lists the synced groups, each with how many members came from Google.
• Under What this connection can do, the Group sync row reads On.

3. How it fits together

User sync and group sync. User sync decides who exists in MangoApps and keeps their name, email and other mapped fields current. Group sync runs after it and only arranges people into employee groups. It never creates anyone. A Google group member who has no MangoApps account is left out of the employee group, not invented.

How a group member is matched. Group sync first looks for the person user sync linked to that Google account. If there is none and the connection matches people by email (it does by default), it looks for an active member here with the same email address. This is how someone with an outside address in a Google group still lands in the right employee group. It will not match:

• an address nobody has confirmed yet;
• an address two members share;
• a deactivated member;
• someone suspended in Google.

Which groups sync. The Group sync page offers four choices:

Choice	What syncs
No groups	Nothing. This is where every connection starts.
Every group in Google Workspace	Every group in the domain.
Groups whose email or name starts with…	Groups matching any prefix you type, e.g. store-, leads-. Letter case is ignored.
Groups I choose	Only the groups you tick in the list.

Before you save, a line under the choices says what Save will do. For example: “Saving syncs 3 groups: store-north, store-south, store-west.” It also says which synced groups a narrower choice will hand back.

Nested groups count. A member of a group inside a synced group is a member of the synced group’s employee group.

A synced group is an ordinary employee group, with one owner per member. Google owns the members it added. Anyone an admin adds to that employee group by hand stays through every sync. The group’s page says “This team is synced from …” and how many members came from Google.

Changes there behave differently because Google is the source:

• Rename the group in Google, not here; the next sync puts Google’s name back.
• Someone you remove by hand comes back on the next sync if they are still in the Google group.
• A synced group cannot be deleted. Remove it in Google, or take it out of the connection’s group sync.

Archived versus handed back. These two are easy to confuse:

• Archived — the group was deleted in Google. Its employee group is deactivated and loses the members Google added. Its name gains “(Google Workspace archived …)”.
• Handed back — you stopped syncing the group (chose No groups, or left it out of your choice). Its employee group stays active with all its members, as an ordinary group nobody syncs. If you choose that group again later, the same employee group (and workspace) is taken back rather than a new one created.

Example: you sync every group, then change to Groups whose email or name starts with… store-. At the next group sync, store-north and store-south stay synced. marketing and finance are handed back as ordinary employee groups, members kept.

Workspaces per group. Optionally, each synced group also gets a workspace with a named owner. Synced members get access without a notification and lose it when Google removes them. People the workspace owner adds stay.

Boundaries with other areas.

• Employee groups: synced groups appear in Employee groups like any other. Admins see a Manage Google Workspace connection link on them there.
• SCIM: a SCIM connection pushes groups to MangoApps instead, and has its own Groups card. A Google Workspace connection pulls them on a schedule.
• Okta, Entra ID and MangoApps Hub: these connections sync people but not groups. The connections list shows “—” in their Synced Groups column.

4. Running it

Let it run on its schedule

Delta sync runs every 4 hours by default, and a full sync weekly. Group sync runs right after each successful full or delta sync, so groups follow Google within the same cycle. A deactivation sync does not trigger a group sync.

Sync groups now

On the connection page, click Sync → Group Sync. It appears once groups are chosen. The run happens in the background. Reload the page when it finishes; a large domain takes a minute or two.

Change which groups sync

1. On the Groups card, click Choose groups.
2. Pick a choice. Read the line under the choices before saving: it says what will sync and what will be handed back.
3. Click Save group sync. A group sync starts straight away when the connection is active.

See who was left out, and why

The Groups card says how many members of the synced groups are not in their employee groups here. Click See who and why to open Sync logs. Each group sync row there shows what the run did, for example “Groups: 132 synced · members: 3 joined · 2 members left out”. Open the row to see, per group, each person left out and the reason:

• suspended in the provider;
• switched off or no longer a member here;
• no Workforce account this connection could match.

Stop syncing groups

Choose No groups and save. Every synced group is handed back at once, with its members kept, and nothing more is read from Google. Deleting the whole connection does the same for its groups.

5. Settings

Setting	Where	Default	What it changes
Groups to sync	Groups card → Choose groups	No groups	Which Google groups become employee groups
Also create a workspace for each synced group	Groups card	Off	Each synced group also gets a workspace; requires a Workspace owner
Unmatched User Policy	Connection → Edit	Skip (don’t create users)	Whether user sync creates people it cannot match. Auto-create users creates them. Group sync never creates anyone.
Delta Sync Frequency	Connection → Edit → Advanced Sync Settings	Every 4 hours	How often changed people sync, and so how often groups sync
Full Sync Frequency	Connection → Edit → Advanced Sync Settings	Weekly	How often everyone is re-read
Field Mappings	Connection page	Google’s default fields	Which Google fields fill which profile fields. Email, first name and last name always come from Google’s default fields when a custom mapping leaves them out.

6. More help

• Identity providers and SCIM — the SCIM connection page explains how pushed groups and people work.
• Employee groups — how employee groups are used across scheduling, audiences and access.
• Ask AI — the assistant answers questions about Google Workspace sync from these articles.