How to set up domain-wide delegation for MonitorWorkspace

[MoniWork]

Setting Up Google Workspace Domain-Wide Delegation

MonitorWorkspace requires domain-wide delegation to access your organization's data through Google's APIs. This guide walks you through the setup.

Prerequisites

• Google Workspace Super Admin account
• Access to Google Cloud Console

Step 1: Create a GCP Project

1. Go to Google Cloud Console
2. Create a new project (e.g., monitorworkspace-prod)
3. Note the Project ID — you'll need it during onboarding

Step 2: Enable Required APIs

In your GCP project, enable these APIs:

• Admin SDK API — User and group management
• Gmail API — Email monitoring and transfers
• Google Chat API — Chat monitoring and exports
• Google Workspace License API — License tracking and user counting

Step 3: Create a Service Account

1. Go to IAM & Admin > Service Accounts
2. Click Create Service Account
3. Name: monitorworkspace-sa
4. Grant no project-level roles (delegation handles permissions)
5. Create a JSON key and download it securely

Step 4: Configure Domain-Wide Delegation

1. In the service account details, click Show domain-wide delegation
2. Check Enable Google Workspace Domain-wide Delegation
3. Copy the Client ID (numeric)
4. Go to Google Admin Console > Security > API Controls > Domain-wide Delegation
5. Click Add new
6. Paste the Client ID
7. Add these OAuth scopes:

https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.group.member.readonly
https://www.googleapis.com/auth/gmail.readonly
https://www.googleapis.com/auth/chat.messages.readonly
https://www.googleapis.com/auth/chat.spaces.readonly
https://www.googleapis.com/auth/apps.licensing
https://mail.google.com/

Step 5: Complete Onboarding

1. Log in to MonitorWorkspace with your Super Admin account
2. Enter your GCP Project ID and upload the service account key
3. MonitorWorkspace will verify the delegation is working
4. You're all set!

Troubleshooting

Issue	Solution
"Delegation denied" error	Wait 5-10 minutes after adding scopes — propagation takes time
"API not enabled"	Double-check all 4 APIs are enabled in your GCP project
Only seeing some users	Ensure the service account is delegating as a Super Admin email
Chat data not appearing	Google Chat API may need separate enablement in Admin Console

---

Having trouble with setup? Post your question below and include any error messages you're seeing.