[Access Control] User Provisioning Settings (Google Workspace)

Target

• Access Control administrators
• Customers who synchronize with Google Workspace using user provisioning

Purpose

• Enable the user provisioning feature from Access Control to Google Workspace.

Notes

1. The content of this article is based on the product specifications as of January 2026 and is subject to change without notice.
2. After performing this procedure, please make all edits (create, update, delete) to user information in Access Control.
3. Changes made in Google Workspace will not be synchronized to Access Control.
4. If you need to add users created in Google Workspace via this feature to Google Groups, please do so separately from Google Workspace.
5. This procedure requires Access Control global administrator privileges and Google Workspace super administrator account information.
6. You cannot check the provisioning results from Access Control to Google Workspace.
   To check provisioning logs, use the Google Workspace Admin console: [Reports] > [Audit and Investigation] > [Admin log events].
   Admin log events (external link)
7. For instructions on how to access the Administration, please refer to the following article.
   How to access the Access Control Administration

Procedure

Google Workspace API Settings

1. Sign in to the Google Admin console with a Google Workspace super administrator account.
2. Go to [Show all] > [Security] > [Access and data control] > [API controls] > [Domain-wide delegation].
3. On the [Domain-wide delegation] screen, click [Add new].

4. Enter the information from Customer Portal provided by HENNGE,  [API Client Registration ①] and click  [Authorize].

   Example configuration string (values will differ for each customer)

   ・Enter the "Client Name" in [Client ID].

   000000000000-0aa0aaaaaaaaaaa00a0aaaaaaaaaa0aa.apps.googleusercontent.com

   ・Enter "one or more API scopes" in [OAuth scopes (comma-delimited)].

   https://www.googleapis.com/auth/admin.directory.user

5. On the [Domain-wide delegation] screen, click [Add new] again.

6. Enter the information from Customer Portal provided by HENNGE,  [API Client Registration ②], and click [Authorize].

   Example configuration string (values will differ for each customer)

   ・Enter the "Client Name" in [Client ID].

   000000000000.apps.googleusercontent.com

   ・Enter "one or more API scopes" in [OAuth scopes (comma-delimited)].

   https://mail.google.com/

7. Verify that the information for the added API clients is displayed on the screen.

Access Control Provisioning Settings

1. Access the Access Control Administration.

2. Select [System] > [Provisioning Settings] from the left menu.

   

3. In the [Sync from Access Control] menu, click [Google Workspace] > [View Details].

   

4. Enter the following settings and click [Save Changes].
   1. [Account provisioning]: "Enabled" (Please enable the toggle.)
   2. [Password provisioning]: "Disabled" (Please disable the toggle.)
   3. [Google Workspace administrator user]: Enter the email address of an account with Google Workspace super administrator privileges.
      * After enabling the setting, any changes (create, update, delete) to user information made in Access Control will be synchronized to Google Workspace.

Notes on Password Provisioning

1. If a Google Workspace password is changed via provisioning, the target user's session will be disconnected.
   When enabling password provisioning, be sure to notify users in advance of the password information to be provisioned.
2. Do not provision passwords synchronized from Active Directory to Access Control.
   Since passwords are hashed, even if provisioned, users will not be able to log in directly to Google Workspace.
3. For the account set as [Google Workspace administrator user], specify an account that will not be deleted in the future.