Connect a Google Workspace

Connect your Google Workspace with Tenable One AI Exposure to reveal a complete inventory of relevant assets.

• This section does not relate to integrating your IdP for the purpose of enabling AI Exposure Console login via SSO. For more information about how to enable login via SSO for users who need access to the Console, see Single Sign-On.
• Tenable also identifies and displays information about external Google groups and users that aren't defined locally in Workspace.
• Even if you don't use Google Workspace, you should proceed with connecting Cloud Identity using the same procedure. Throughout the Console, the term Google Workspace is used interchangeably with Cloud Identity.

If you're using Tenable to monitor your GCP environment, it is recommended to connect your Google Workspace before you connect your projects/organization.

For answers to common questions that may arise about granting Tenable certain permissions during this integration, see Google FAQ and Troubleshooting.

Prerequisites

Before you begin:

• Grant sufficient permissions to the user who will create projects, create service accounts, and authorize the service accounts in the Google Cloud Console.
• Grant admin permissions to the user who will perform actions in the Google Workspace Admin Console.
• Create a dedicated project for each Google Workspace that will host the service account used by Tenable.
• Enable billing for the dedicated project in the Google Cloud Console. For instructions, see Google's documentation on enabling billing.
• Terraform-specific:
  • Ensure you have Terraform CLI v0.13+ installed.
  • Ensure terraform init can download and install Google Cloud provider v7.11+ without conflicting with your existing configurations.

Add a Workspace

Follow the steps described here to add a Google Workspace to AI Exposure. This process consists of:

• Creating a service account for Tenable in your GCP Organization.
• Assigning permissions to the service account.

To add a Google Workspace:

1. In the AI Exposure Console, navigate to Settings > Integrations and click + Add Integration.
2. In the Integrations Library, click Google Workspace. The Google Workspace wizard opens.
3. In the wizard:
   1. Enter a name for the integration.
   2. For Customer ID, open the Google Admin console, navigate to Account > Account settings, and copy the Customer ID.

   3. Under Deployment, select one of the following deployment options to create a service account for Tenable in a dedicated project:

      • Cloud Shell. Script-based deployment. Copy the script that appears in the wizard and run it in a dedicated GCP project to grant AI Exposure the required permissions.
        1. In the Google Cloud Console, create a new project for Tenable.
        2. Activate the Cloud Shell within the newly created project.
        3. Copy the script displayed in the AI Exposure wizard and run it in your Cloud Shell.
        4. Wait until the script has completed successfully, and then copy the Service Account Email from the output.
      • Terraform. Module-based deployment. See Prerequisites before deploying.
        1. Enter the Management Project ID. This is the ID of the dedicated project hosting the service account for this integration.
        2. In the Google Cloud Console, navigate to the project you created.
        3. Go to IAM & Admin > Labels, click + Add label, and add the key/value pair that appears in the AI Exposure wizard.
        4. Copy the module invocation displayed in the AI Exposure wizard, add it to your Terraform configuration, and then run terraform apply. The module creates the identity and grants Tenable the permissions to connect and scan the environment.
      • Manual. Manually, via the Google Cloud Console. See Manually Deploy a Google Workspace for step-by-step instructions.
      Caution: When you finish manual deployment, return to the wizard to complete Post Deployment.
   4. Under Post Deployment GCP Settings, enter the service account email. Retrieve the email in one of the following ways, depending on the deployment method you chose in the previous step:
      • Cloud Shell — Wait until the script completes successfully, then copy/paste the service account email from the generated output.
      • Terraform — Retrieve the service account email (tenable_service_account_mail) from the Terraform output.
      • Manual — See Manually Deploy a Google Workspace.

   5. Under Post Deployment Google Workspace Settings, grant Tenable permissions to the Google Workspace.

      1. Custom role: Supports all core functionality within AI Exposure. This option is recommended for most organizations.
      2. Domain-wide delegation: Designed for organizations that require advanced IAM functionality. For more information, see Added IAM Capabilities with Domain-Wide Delegation.

      For more information about why these permissions are needed, see Google Required Permissions.

4. Click Finish.

Grant Permissions via Custom Role (Recommended)

Grant permissions to the Google Workspace via a custom role.

This method supports all core functionality within AI Exposure, including Just-In-Time access. This option is recommended for most organizations.

1. In the Google Admin console, navigate to Account > Admin roles and then click Create new role.
2. Enter a Name and Description, and then click CONTINUE.

3. Under Select Privileges > Admin API privileges, select the privileges listed under 2a. Custom role (Recommended) in Required Permissions.

   Note: The optional Groups > Update privilege lets you leverage Just-In-Time access to temporarily add users to Google Workspace groups.
4. Click CONTINUE and then click CREATE ROLE.
5. In the Admin roles page of the newly created role, click Assign service accounts.
6. Enter the service account email that you created in step 2 of the AI Exposure wizard, click ADD, and then click ASSIGN ROLE.

Grant Permissions via Domain-Wide Delegation (Advanced)

Grant permissions to the Google Workspace via domain-wide delegation.

Designed for organizations that require advanced IAM functionality, and also supports Just-In-Time access. For more information, see Added IAM Capabilities with Domain-Wide Delegation.

1. In the Google Cloud console, navigate to the service account that you created in step 2 of the AI Exposure wizard, and in the Details tab, click to expand the Advanced settings section.
2. Copy the Client ID and click View Google Workspace Admin Console.
3. In the Admin console, navigate to Security > Access and data control > API controls.
4. Click on MANAGE DOMAIN WIDE DELEGATION and then click Add new.
5. Paste the Client ID that you copied earlier.

6. Copy and paste the following OAuth scopes:

   Copy

   https://www.googleapis.com/auth/cloud-identity.groups.readonly,
   https://www.googleapis.com/auth/admin.directory.customer.readonly,
   https://www.googleapis.com/auth/admin.directory.group.readonly,
   https://www.googleapis.com/auth/admin.directory.orgunit.readonly,
   https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,
   https://www.googleapis.com/auth/admin.directory.user.readonly,
   https://www.googleapis.com/auth/admin.reports.audit.readonly,
   https://www.googleapis.com/auth/cloud-identity.inboundsso.readonly

7. (Optional) If you want to leverage Just-in-Time (JIT) access to temporarily add users to Google Workspace groups in this organization, add the following OAuth scope: JIT OAuth scope.
8. Click AUTHORIZE.
9. Enter the User Email of the relevant Google Admin console user in the AI Exposure wizard.
   • User must be assigned the Super Admin role
   • To assign or view users with this role, go to Account > Admin roles, hover over Super Admin, and click Assign admin or View admins.
   • Actual permissions granted to Tenable are limited to the OAuth scopes granted earlier.

Manually Deploy a Google Workspace

Manually deploy your Workspace via the Google Cloud Console. This procedure is relevant if you selected Manual for the Deployment type when adding your workspace.

1. In the Google Cloud Console, create a new project for Tenable, or navigate to an existing project (not recommended).
2. Within the newly created project, navigate to IAM & Admin > Roles and then click +Create Role.
3. Enter a Title, Description, and ID.
4. Click + Add Permissions, and add the permissions listed under Create Service Account in Required Permissions.
5. Click Create to finish creating the role.
6. Click on the Service Accounts tab and then click + Create service account.
7. Enter a Service account name, ID, and description and then click Create and continue.
8. Select the custom role you created and click Continue, and then Done.

9. Click on the newly created service account, go to the Principals with access tab, and click + Grant access.

   Important: If you are unable to grant access, you may have an organization policy with a domain restriction constraint that prevents choosing Tenable as a principal in IAM policies. This prevents Tenable from impersonating the created service account. If this is the case, follow the procedure described in Add Tenable as an Allowed Domain.
10. Insert [email protected] in the New principals field and choose the Service Account Token Creator role. Click Save to finish.
11. Copy and save the email of the service account you created. Visible under IAM & Admin > Service Accounts, in the Email field. You will need to enter this in the AI Exposure Console.
12. Go to IAM & Admin > Labels, click + Add label and add the key/value pair that appears in the AI Exposure wizard.
13. Click Save to finish.
14. Navigate to APIs & Services > Enabled APIs & services, select Service Usage API and click ENABLE.
15. [AI Exposure Console] Return to the wizard and continue with Post Deployment GCP Settings. See Add a Workspace.

Add Tenable as an Allowed Domain

If you are unable to grant access to the created service account, you may have an organization policy with a domain restriction constraint that prevents choosing AI Exposure as a principal in IAM policies. This prevents Tenable from impersonating the created service account. If this is the case, follow the procedure described here.

To add Tenable as an allowed domain:

1. In the Google Cloud console, within the project where the service account was created, navigate to IAM & Admin > Organization Policies.

   Note: If you use Tenable for workload scanning across all projects, you must add Tenable as an allowed domain at the top-level organization policy.
2. In the Filter, search for and then select Domain restricted sharing, and then click on the policy to open it.
3. Click MANAGE POLICY.
4. In the Rules section, click ADD A RULE.
5. Under Policy values, choose Custom.
6. Under Policy type, choose Allow.
7. Under Custom values, enter the following value: C00ndl9ht

Added IAM Capabilities with Domain-Wide Delegation

If you grant permissions to the service account via domain-wide delegation, the following additional IAM capabilities are supported.

• Admin roles — Gain visibility into your Google Workspace admin roles. Admin roles define administrators' access and control over the organization's environment, including which settings, data, and administrative functions they can manage. With domain-wide delegation, you can see:
  • Which admin roles exist in your environment
  • Role assignments (providing insights into administrative access and privilege distribution.)
• SSO Profile — Improve the accuracy of MFA-related findings via visibility into your Workspace’s SSO configuration. SSO profiles indicate whether multi-factor authentication (MFA) is enforced through third-party identity providers (IdPs).
  • No MFA label behavior — When an SSO profile is detected, AI Exposure assumes MFA is enforced at the third-party IdP level and does not assign the No MFA label to affected identities.
  • Impact on finding severity — Without this visibility, finding severity related to MFA enforcement is less granular, potentially affecting risk assessments.
• Inactive users — Reduce false positives in inactivity findings by distinguishing between truly inactive users and those active via API access. With domain-wide delegation:
  • AI Exposure can detect API-only activity, even if a user hasn’t logged into the UI.
  • This ensures only genuinely inactive principals are flagged, improving the relevance and precision of inactivity-related findings.

Update the Integration Name

You can modify the name of your Google Workspace integration/s, reflecting how the integration is displayed in AI Exposure. This can be useful for better organization and identification, especially if you have multiple identity provider integrations.

To update the name:

1. In the AI Exposure Console, navigate to Settings > Integrations and click on Google Workspace.
2. Next to the relevant integration, click the three dots menu, and then Edit.
3. Navigate to step 1 in the wizard (Workspace Details) and update the Name field.
4. Click Next to progress to the last step, and then click Update.