Prepare Google Workspace
- Enable the Admin SDK Directory API in an organization-controlled Google Cloud project.
- Create a dedicated service account and enable domain-wide delegation.
- Authorize only the read-only Directory API scopes required for user and optional group data.
- Choose a delegated administrator that can read the intended staff population.
Configure the source
- Enter the Workspace customer ID, delegated administrator email, and service account JSON.
- Prefer staff organizational units or explicit groups instead of the whole customer.
- Exclude student, alumni, contractor, resource, and automation organizational units.
- Add every permitted primary email domain and choose locked profile fields.
- Save the draft and verify that suspended accounts and non-person objects are absent from the expected population.