--- title: "Google Workspace Admin Integration" description: "Connect AI agents to the Google Workspace Admin SDK Directory API. Agents create and manage users, groups, and organizational units, control membership, manage admin roles and aliases, and audit devices and domains." url: https://flowrunner.ai/integrations/google-workspace-admin date_modified: 2026-08-01T02:40:32-07:00 --- # Google Workspace Admin [Identity & Security](https://flowrunner.ai/integrations/category/identity-security) Connect AI agents to the Google Workspace Admin SDK Directory API. Agents create and manage users, groups, and organizational units, control membership, manage admin roles and aliases, and audit devices and domains. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 31 actions · OAuth · available [Google Workspace Admin website](https://google.com/) · [Platform Documentation](https://developers.google.com/admin-sdk/directory/reference/rest/v1) · Capability data verified 2026-07-14 1. A new-hire record starts an onboarding flow 2. Agent reads the hire's name, department, and org-unit placement 3. Create User and place them in the correct organizational unit 4. Add Group Member for each team mailing list the role requires 5. Agent confirms membership with Check Has Member 6. The manager receives the temporary password and first-sign-in instructions 7. Admin confirms an account reassignment before offboarding deletes the user ## What This Integration Enables Agents automate onboarding by creating a user, placing them in an organizational unit, and adding them to the right groups, automate offboarding by suspending, deleting, or reassigning a departing account and its memberships, keep group membership in sync with an external system of record, audit administrator role assignments, domains, and synchronized mobile devices for compliance reporting, and grant or revoke super administrator privileges and manage user aliases. Users are addressed by primary email or unique id, groups by email or id, and organizational units by path; the read-only scopes for domains, roles, and mobile devices mean those operations are list and read only. Undeleting a user requires the unique id because a deleted account has no email. The connector covers the user, group, org-unit, role, and device surface of the directory; the surrounding flow decides which steps run automatically and where an admin confirms an irreversible offboarding action. ### Without FlowRunner **Manual onboarding**: Users are created and placed in org units by hand, and group setup varies per hire **Risky offboarding**: A departing user is deleted before their data or roles are reassigned **Access audits on demand**: Admin role assignments and devices are only reviewed when compliance requires it ### With FlowRunner **Repeatable onboarding**: Create User, org-unit placement, and Add Group Member run identically every time **Staged offboarding**: Suspend User first, then delete or reassign only on a human's confirmation **Scheduled audits**: Users, role assignments, domains, and mobile devices are enumerated on a routine ## Use Case Scenarios ### New-hire onboarding with org-unit placement A new-hire record starts the flow. The agent calls Create User and places the account in the correct organizational unit, then Add Group Member for each team mailing list the role needs. It emails the manager the temporary password and first-sign-in instructions with [Gmail](https://flowrunner.ai/integrations/gmail-service). Every hire gets the same placement and access, so the directory stays organized and the manager has what they need on day one. ### Offboarding with staged cleanup An offboarding trigger starts the flow. The agent calls Suspend User immediately to cut access, records the user's group memberships and org-unit placement, and prepares the reassignment. Suspension is reversible, so access is contained without an irreversible delete happening on the trigger alone. The final delete or reassignment waits for a human. ### Access-audit report On a routine, the agent lists users (including deleted accounts) and role assignments to build an access-audit record, then writes each entry to a tracking sheet with [Google Sheets](https://flowrunner.ai/integrations/google-sheets). An unexpected super administrator, or a stale account that should have been removed, surfaces as an exception for review. ## Human-in-Loop Highlight Deleting or reassigning a departing user's account is the offboarding step that should pause for an admin, because it is irreversible and it touches the person's data and ownership. The agent handles the safe, reversible work on its own: it suspends the account to cut access immediately and records the user's groups and org-unit placement. Before it deletes or reassigns, it stops and asks the admin through their channel: "Offboarding \[user\] is suspended, held groups \[list\], owns \[resources\]. Delete the account, reassign its data to \[manager\], or keep suspended pending review?" The admin decides. The agent contains access; the person owns the irreversible cleanup. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via preferred channel Human decides Agent resumes with decision ## Agent Capabilities 19 actions ### Users 7 - **Create User** Creates a user and places them in an organizational unit during onboarding. - **Suspend User** Suspends a user's account without deleting it. Reversible, so agents run it first during offboarding. - **Unsuspend User** Restores a suspended user's access. - **Delete User** Deletes a user account. The typical human-gated offboarding step. - **Undelete User** Restores a recently deleted user by unique id. - **Make User Admin** Grants or revokes super administrator privileges. Typically human-gated. - **Add User Alias** Adds an email alias to a user. ### Groups and Members 5 - **Create Group** Creates a Workspace group. - **Add Group Member** Adds a member to a group with a Member, Manager, or Owner role. - **Update Group Member** Changes a member's role within a group. - **Remove Group Member** Removes a member from a group. - **Check Has Member** Tests whether a user is a member of a group. ### Org Units 3 - **Create Org Unit** Creates an organizational unit under a parent path. - **Update Org Unit** Updates an organizational unit. - **List Org Units** Lists organizational units. ### Audit (read only) 4 - **List Roles** Lists admin roles. - **List Role Assignments** Lists admin role assignments for a compliance audit. - **List Domains** Lists the account's domains. - **List Mobile Devices** Lists synchronized mobile devices for a compliance report. ## Frequently Asked Questions ### What can FlowRunner do with Google Workspace Admin? FlowRunner agents can run List Users, Get User, and Create User in Google Workspace Admin, plus 28 more actions. ### Does connecting Google Workspace Admin to FlowRunner require OAuth? Yes. Google Workspace Admin connects to FlowRunner with OAuth 2.0, so agents authenticate without handling raw credentials. ### Can Google Workspace Admin trigger a FlowRunner workflow automatically? Google Workspace Admin doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger. **Work at Google Workspace Admin?** This integration exposes Google Workspace Admin to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/google-workspace-admin. Site index: https://flowrunner.ai/llms.txt