Skip to main content

Google Workspace Admin

Google Workspace Admin administers your Google Workspace tenant through the Admin SDK: users, groups and members, organizational units, ChromeOS and mobile devices, and audit and usage reports.

This is the administrative counterpart to the Google Workspace connector. That one works across the productivity suite, Drive, Docs, Sheets, and Slides; this one acts on the directory itself.

caution

Every tool here runs against your whole tenant, not one person's data. Suspend User and Remove Group Member change who can sign in and what they can reach. Scope this connector to a group of administrators rather than All Users, and consider a runtime guard that requires approval on the write tools. See Guards.

Authentication Types​

  • Instant OAuth - Use Willow's pre-configured Google app for the fastest setup.
    • Pros: no Google Cloud project to configure
    • Cons: consent and audit trail belong to Willow's app
  • OAuth - Register your own OAuth client in a Google Cloud project you control.
    • Pros: your own consent screen, your own scope grants, your own Cloud audit logs
    • Cons: needs a Google Cloud project and a Workspace super administrator

Whoever authorizes must hold an admin role with the privileges for the operations you enable. The Admin SDK enforces Workspace admin roles on top of the OAuth scope, so a scope grant alone does not let a non-admin create users.

Setting up OAuth​

Enable the API and create credentials​

  1. In the Google Cloud console, select or create the project you want to own this integration.
  2. Enable the Admin SDK API (admin.googleapis.com) for that project.
  3. Configure the OAuth consent screen for your organization as an internal app.
  4. Create an OAuth 2.0 Client ID of type Web application.
  5. Add the redirect URL Willow shows on the connector's Setup tab as an Authorized redirect URI. Copy it from Willow so it matches exactly.
  6. Copy the generated Client ID and Client Secret.

Configure it in Willow​

  1. In Willow, open Build > MCP Servers > Add MCP Server, search for Google Workspace Admin, and select Use.
  2. Review the risk level and tool list, then select Create.
  3. On the server's Setup tab, choose OAuth.
  4. Paste the Client ID and Client Secret, add the scopes below, and select Save Changes.
  5. Authorize as a Workspace administrator. Google shows the scopes you requested on the consent screen.

Scopes each tool group needs​

ToolsAdmin SDK scope
List Users, Get User, Create User, Update User, Suspend Userhttps://www.googleapis.com/auth/admin.directory.user
List Groups, Get Group, Create Grouphttps://www.googleapis.com/auth/admin.directory.group
List Group Members, Add Group Member, Remove Group Memberhttps://www.googleapis.com/auth/admin.directory.group.member
List Org Units, Get Org Unithttps://www.googleapis.com/auth/admin.directory.orgunit
List ChromeOS Deviceshttps://www.googleapis.com/auth/admin.directory.device.chromeos
List Mobile Devices, Action Mobile Devicehttps://www.googleapis.com/auth/admin.directory.device.mobile
List Audit Activities, Get User Usage Reporthttps://www.googleapis.com/auth/admin.reports.audit.readonly and https://www.googleapis.com/auth/admin.reports.usage.readonly

Read-only variants exist for most of these, ending in .readonly. If you enable only the List and Get tools, grant the read-only scope instead and the connector cannot write even if a tool is later turned on by mistake. Google's reference lists the scope on every method; see the Admin SDK Directory API documentation.

Available Tools​

The connector exposes 18 tools. At the default Medium Risk level Willow enables 17 and holds back Remove Group Member.

Read-only​

List Users, Get User, List Groups, Get Group, List Group Members, List Org Units, Get Org Unit, List ChromeOS Devices, List Mobile Devices, List Audit Activities, Get User Usage Report

Create and update​

Create User, Update User, Suspend User, Create Group, Add Group Member, Action Mobile Device

Delete​

Remove Group Member, classified high risk and excluded at Medium.

Troubleshooting​

403 Not Authorized to access this resource/api. The authorizing account is not a Workspace admin, or its admin role lacks the privilege for that call. The OAuth scope is necessary but not sufficient.

Admin SDK API has not been used in project ... before or it is disabled. Step 2 was skipped, or the credentials belong to a different Cloud project than the one where the API was enabled.

A newly created user fails the next call. Google propagates user creation asynchronously and documents that immediately following mutations can fail. Retry after a short pause.

The redirect is rejected. The authorized redirect URI in the Cloud console does not match Willow's exactly. Re-copy it from the Setup tab.

On this page