[Access Control] User Provisioning Settings (Google Workspace)

Overview

• This article explains the procedure for administrators of Access Control who synchronize users with Google Workspace to enable the user provisioning feature from Access Control to Google Workspace.

Notes

1. The content of this article is based on the product specifications as of July 2026 and may be subject to change without notice.
2. After performing this procedure, please edit user information (create, update, delete) from Access Control.
3. Changes made in Google Workspace will not be synchronized to Access Control.
4. If you need to add users created in Google Workspace via this feature to Google Groups, please perform this operation separately in Google Workspace.
5. This procedure requires Access Control global administrator privileges and Google Workspace super administrator account information.
6. You cannot check the provisioning results from Access Control to Google Workspace.
   To check provisioning logs, please refer to the Google Workspace Admin Console under [Reports] > [Audit and Investigation] > [Admin log events].
   Admin log events (external link)
7. For instructions on how to access the Administration, please refer to the following article.
   How to access the Access Control Administration

Procedure

Google Workspace API Settings

*For the values to be set in API Clients registration, please refer to [Connected Service Settings] under [Service List] > [HENNGE Access Control] in the Customer Portal.
[Customer Portal] How to check the HENNGE One service list

1. Log in to the Google Admin Console with a Google Workspace super administrator account.
2. Go to [Show all] > [Security] > [Access and data control] > [API controls] > [Domain-wide delegation].
3. On the [Domain-wide delegation] screen, click [Add new].

4. Enter the information for [API Client Registration ①] obtained from the Customer Portal and click [Authorize].

   Enter the "Client Name" in [Client ID].

   000000000000-0aa0aaaaaaaaaaa00a0aaaaaaaaaa0aa.apps.googleusercontent.com

   Enter the following value in [OAuth scopes (comma-delimited)].

   https://www.googleapis.com/auth/admin.directory.user

5. On the [Domain-wide delegation] screen, click [Add new] again.

6. Enter the information for [API Client Registration ②] obtained from the Customer Portal and click [Authorize].

   ・Enter the "Client Name" in [Client ID].

   000000000000.apps.googleusercontent.com

   ・Enter the following value in [OAuth scopes (comma-delimited)].

   https://mail.google.com/

7. Confirm that the information for the API Clients you added is displayed on the screen.

Access Control Provisioning Settings

1. Access the Access Control Administration.

2. Select [System] > [Provisioning Settings] from the left menu.

   

3. In the [Sync from Access Control] menu, click [Google Workspace] > [View Details].

   

4. Enter the following settings and click [Save Changes].
   1. [Account provisioning]: "Active" *Please enable the toggle.
   2. [Password provisioning]: "Disabled" *Please disable the toggle.
   3. [Google Workspace administrator user]: Enter the email address of an account with Google Workspace super administrator privileges.
      *After enabling this setting, changes to user information (create, update, delete) made in Access Control will be synchronized to Google Workspace.

Notes on Password Provisioning

1. If the password for Google Workspace is changed via provisioning, the target user's session will be disconnected.
   When enabling password provisioning, be sure to communicate the password information to be provisioned to users in advance.
2. Do not provision passwords synchronized from Active Directory to Access Control.
   Since passwords are hashed, even if provisioned, users will not be able to log in directly to Google Workspace.
3. For [Google Workspace administrator user], specify an account that will not be deleted in the future.