Skip to content

Google Workspace Gemini adoption

Google Workspace supplies per-user Gemini adoption context for workforce AI usage inside Workspace.

Onboarding scope

This guide covers the read-only google_workspace_gemini connector in the Venturi platform connector package. It reads Gemini audit events and directory users and grants no user, license, or directory mutation.

Required access

Grant a service account these read-only OAuth scopes through domain-wide delegation. They are vendor permissions; enter the full scope URLs exactly as written:

Google OAuth scope Purpose
https://www.googleapis.com/auth/admin.reports.audit.readonly Read Gemini audit events through the Reports API.
https://www.googleapis.com/auth/admin.directory.user.readonly Resolve report actors to directory users.

Domain-wide delegation lets the service account act as a Workspace user, and every delegated call names the user it impersonates. Venturi impersonates a dedicated admin account that holds a custom admin role with only the Reports privilege and the Users → Read privilege, so the delegated calls can read audit events and directory users and nothing else. See Google’s service account delegation guide and administrator privilege definitions.

Adoption comes from Reports API audit events: the connector calls activities.list with applicationName=gemini_in_workspace_apps and reads the feature_utilization events of type ai_usage_event. Their app_name, action, event_category, and feature_source parameters name the Workspace app, the action, the kind of interaction, and where it started. Google retains these events for a rolling 180 days, so keep the lookback at or below 180 days. The Gemini reports in the Admin console (Menu → Generative AI → Gemini reports) summarize the same adoption for administrators; the connector reads the per-user Reports API events instead. See Google’s Gemini in Workspace Apps activity events, activities.list reference, and Gemini usage reports.

Google’s Enterprise License Manager API exposes only one OAuth scope, https://www.googleapis.com/auth/apps.licensing, and it is read/write, so Venturi does not request it. See Enterprise License Manager authorization. If license context is required, provide a customer-generated license export through the approved onboarding channel. Do not grant user, license, or directory mutation permissions.

Setup

  1. Create a dedicated service account for the Venturi integration.
  2. In the Google Admin console, create a custom admin role with only the Reports privilege and the Users → Read privilege. Assign it to a dedicated admin account for Venturi that holds no other admin role.
  3. As a super administrator, open Menu → Security → Access and data control → API controls → Manage Domain Wide Delegation in the Google Admin console, select Add new, enter the service account’s client ID, add both scope URLs above, and select Authorize. See Control API access with domain-wide delegation.
  4. Store the service account key as an encrypted credential reference in Settings / Admin / Credentials.
  5. Configure VENTURI_GOOGLE_WORKSPACE_CUSTOMER_ID. The default lookback is 30 days; set VENTURI_GOOGLE_WORKSPACE_LOOKBACK_DAYS to change it. See sync windows and failure behavior.
  6. In Venturi, go to Integrations / Google Workspace Gemini, enter the dedicated admin account’s email address as the delegated admin that the service account impersonates, and run Test connection.

Verification

  • Test connection passes the read-only boundary check: audit-event and directory reads succeed, and the delegation holds no write scope.
  • The delegated calls impersonate the dedicated admin account, and that account holds only the Reports and Users → Read privileges.
  • Per-user adoption rows appear in the latest sync.
  • License context appears only when supplied by an approved customer export.
  • The connector preserves one normalized adoption record per user instead of collapsing everything to tenant totals.
  • The connector inventory marks Google Workspace Gemini as read-only.

Rotation and offboarding

Rotate the service account key through Google Cloud administration, then update the credential reference in Settings / Admin / Credentials. Removing the connector stops new Gemini adoption syncs; also remove the client ID from domain-wide delegation and remove the custom admin role from the dedicated admin account.

Give feedback on this page

Sign in to send feedback. Opens in a new tab.

Copy page details 
Docs feedback: Google Workspace Gemini adoption
Page: https://docs.venturi.systems/connectors/google-workspace-gemini/