Configuring Google Workspace Integration

Configuring Google Workspace Integration

This article explains how to configure Google Workspace for ChromeOS within Lenovo Device Orchestration (LDO). This setup enables LDO to securely connect with your organization’s Google Cloud environment and retrieve ChromeOS device data for monitoring and management.

Once the configuration is complete, you can proceed to onboard ChromeOS devices to Device Management.
Info
Only one Google Cloud connection can be configured per LDO organization.

I. Open two browser tabs. You will need these tabs throughout the process.

  1. Go to the Google Workspace Admin and log in.
  2. Go to Google Cloud and log in.  https://console.cloud.google.com/

II. Create a Google Cloud Project and enable API Access

  1. Go to the Google Cloud tab. In the left-hand menu, click APIs & Services > Enabled APIs  & services. 
  2. Click Create Project, then enter a project name (e.g. “ldo-cloudconnector”).
  3. On the project page, select Enable APIs and services. 
  4. In the library, search for the Admin SDK API, then enable it.
  5. Return to Enable APIs and services. 
  6. Search for the Chrome Management API and enable it. 

III. Create a Google Cloud Service Account

  1. On the same tab, in the left-hand menu, click IAM & Admin > Service Accounts. 
  2. Select the Project you created (if not already selected) and click Create a Service Account.
  3. Complete the folowing fields:
    1. Service Account Name (e.g. “ldo-cloudconnector-user”).
    2. Service Account ID (automatically generated by Google).
    3. Service Account Description (optional).
  4. Continue without granting roles or permissions to this service account.
  5. Copy the service account email (e.g. “ldo-cloudconnector-user@ldo-cloudconnector.iam.gserviceaccount.com”).

IV. Create Credentials for the Service Account

  1. On the same tab:  
    1. Select the Service Account you just created.
    2. Go to Keys > Add Key > Create New Key.
    3. Select JSON.
    4. The JSON Credential will be downloaded to your device (keep this file secure).

V. Configure Domain-wide Delegation

  1. Return to Service Accounts on the same tab in Google Cloud.  
  2. Select the Service Account you just created.
  3. Expand Advanced Settings and copy the Client ID (e.g. “123456789012345678901”).
  4. Switch to the Google Workspace Admin tab.
  5. Go to Security > Access and data control > API Controls
  6. Click Manage Domain Wide Delegation > Add New
  7. Paste the Service Account’s Client ID.
  8. Paste the following OAuth Scopes (one at a time):
  9. Authorize and confirm consent.

VI. Enable Device Telemetry Reporting

  1. Log in to Google Workspace Admin https://admin.google.com .
  2. Go to Devices > Chrome > Settings > Device Settings.
  3. Scroll to User and Device Reporting section, select Report Device Telemetry.
  4. If not already, enable the following components for your Organizational Unit:
    1. Power Status
    2. Network Status
    3. Storage Status
    4. Network Configuration
  5. Save Changes.

VII. Create Google Workspace Admin Role

  1. On the same tab, go to Account > Admin Roles.
  2. Create new role and name it (e.g. “LDO Connector Admin”)
  3. Select the following Privileges (you will have to scroll several pages):
    1. Chrome Management > Manage ChromeOS Devices > Read > Telemetry API
    2. Organization Units > Read
  4. Click Continue and Create role.
  5. Click Assign service accounts
  6. Enter the service account email address (e.g. “ldo-cloudconnector-user@ldo-cloudconnector.iam.gserviceaccount.com”). To copy and paste, switch to the Google Cloud tab, in the left-hand menu, select IAM & Admin > Service accounts.
  7. Click Add and Assign Role.

VIII. Configure Google Cloud Connector

  1. Sign in to LDO.
  2. Go to Configuration & Settings > Organization Settings > Organization Account > Connectors tab.
  3. Click Add Connection.
  4. Enter the Customer ID from the Google Workspace Admin tab.
  5. Enter your Google Workspace administrator email address. 
  6. Upload the JSON file you downloaded earlier.
  7. Click Connect.
  8. After the connection is established, you can onboard ChromeOS devices. For more information, see Onboarding Chrome Devices.
Managing Connectors
  1. Click Manage connector.
  2. Update the connector settings as needed or upload a new file.
  3. If applicable, update the Admin email address.
  4. Click Connect.
Disconnecting Google Cloud Connector
  1. Click Disconnect Platform.
  2. Optionally, select Remove all Chrome devices from LDO to remove all onboarded ChromeOS devices and their associated UDS services.
  3. Click Proceed.