Google Workspace user provisioning

Google Workspace provisioning syncs learners from the Google Admin SDK Directory API. It is separate from Google SSO: SSO signs users in, while directory sync keeps learner records up to date.

Prerequisites

• You must be a Prventi organization owner or have permission to manage learners.
• You must be a Google Workspace administrator who can grant Admin SDK Directory API access.
• The Google Workspace account must allow third-party OAuth app consent for Prventi.

Prventi requests these read-only scopes:

• https://www.googleapis.com/auth/admin.directory.user.readonly
• https://www.googleapis.com/auth/admin.directory.orgunit.readonly

Connect Google Workspace

1. Open Settings > Team Provisioning in Prventi.
2. In the Google Workspace panel, select Connect.
3. Sign in with a Google Workspace administrator account.
4. Review and approve the requested Admin SDK scopes.
5. Prventi validates the connection by reading one directory user with admin view access.

After connection, the panel shows the connected admin email, Workspace domain, status, last sync time, and the last sync error if one occurs.

Sync behavior

Prventi imports Google Workspace users as learners. New learners are created as Pending and are not automatically invited.

Field mapping:

• Google id becomes the Prventi directory identity.
• Google primaryEmail becomes the learner email.
• Google name.givenName and name.familyName become first and last name.
• Google organizations[].department becomes department.
• Google organizations[].title becomes job title.
• Google manager relation email becomes manager email and manager identifier.

Users missing a first name, last name, email, or Google id are skipped and recorded on the sync run.

Organizational unit filtering

By default, Prventi syncs all users visible to the connected administrator. If organizational unit filtering is configured, Prventi syncs users in the selected OU paths and their child OUs.

Users removed from the selected OU scope are deactivated only when they are already linked to the Google Workspace directory identity. Manually managed learners are not deactivated by Google Workspace sync.

Deactivation rules

Prventi deactivates linked learners when the Google user is suspended, archived, deleted, or no longer included in the configured OU scope. Prventi never destroys learners during directory sync.

If a learner was deactivated by Google Workspace sync and later appears as active again, Prventi reactivates the learner to Pending.

Manual sync

Use Sync now from Settings > Team Provisioning to start a sync. The sync runs in the background and updates the Google Workspace panel when it completes or fails.

Disconnect

Use Disconnect to disable future Google Workspace sync and remove stored OAuth tokens. Existing learners and directory identity links remain in Prventi for auditability.