> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-gcp/onboard-gcp-workspace.md).

# Onboard Your Google Workspace

Connect your Google Workspace account to Prisma Cloud to monitor your users, groups, and group memberships.

If you use Workspace as an IdP for user and group management and want visibility and security of those accounts, onboard the Workspace accounts to Prisma Cloud. After onboarding, you can configure alert rules for Workspace related custom policies.

You need to complete steps on your Workspace console and the Prisma Cloud console.

Before you begin, make sure to enable the `admin.googleapis.com` service in your Google Cloud project.

1. **Configure your Workspace Account**
   1. Go to [Google Workspace](https://workspace.google.com/intl/en_in/)
   2. Click **Admin console** on the top right of the page.
   3. Log in using your Google ID.
   4. Select **Account > Admin roles** from the left navigation.

      <figure><img src="/files/ClfkKJipyMsY7GuSkdRC" alt="configure gcp workspace 1"><figcaption></figcaption></figure>
   5. Create a **prisma-gcp-workspace-readonly** custom role with the following **Admin API privileges**:
      * Organizational Units - Read
      * Users - Read
      * Groups - Read

        <figure><img src="/files/m0WJZYdTtAYzJJ6L1f4K" alt="configure gcp workspace 2"><figcaption></figcaption></figure>
   6. Select the role and click **Assign admin**.
   7. Create a service account in the onboarded GCP project, generate a **Service Account Key** (JSON), and copy the client email.
   8. Under Admin, click **Assign service accounts**.
   9. Enter the service account client email that you created and copied in Step 7 above: \<example>@\<project-name>.iam.gserviceaccount.com
   10. Click **Add**.

       <figure><img src="/files/BFyUoVVcGtQAB8WkpJlf" alt="configure gcp workspace 3"><figcaption></figcaption></figure>
   11. Click **Assign Role**.

       Your **Service Account** is now associated with the **prisma-gcp-workspace-readonly** Admin role and the configuration on the GCP Admin console is complete. Next, you need to connect your Google Workspace to Prisma Cloud.
2. **Connect your Workspace Account to Prisma Cloud**
   1. Select **Settings > Providers > Cloud Accounts**.
   2. From the **Connect Provider** drop-down, select **Cloud Account**.
   3. Select **Google Cloud Platform** as the cloud provider you want to onboard and **Get Started**.
   4. Under **Scope**, select **Workspace**.

      <figure><img src="/files/LRDLWWi2x0hjdZCxPZuN" alt="gcp add workspace 1"><figcaption></figcaption></figure>
   5. Under **Security Capabilities and Permissions**, the **Foundational** capabilities are enabled, by default:
      * **Misconfigurations (CSPM)** grants the permissions required to scan cloud resources and ingest metadata.
      * **Identity Security** grants the permissions required to calculate net effective permissions for identities and manage access.
   6. Click **Next**.
   7. To **Configure Account**, enter **Domain Name** and **Account Name**.

      Make sure that the Domain Name matches the Primary Domain Name in the GCP Workspace Admin console.

      <figure><img src="/files/iRN4Rta4ZXdGRD96GASg" alt="gcp workspace domain 1"><figcaption></figcaption></figure>

      An account name is auto-populated for you. You can replace it with an account name that uniquely identifies your Google Workspace on Prisma Cloud.

      <figure><img src="/files/7sZ5RoX85EDsG3TuaPnH" alt="gcp add workspace 2"><figcaption></figcaption></figure>
   8. Upload the **Service Account Key (JSON) file** that you generated and saved while configuring your Workspace account in Step 1.7 above.
   9. Select the [Account Group](/content-collections/administration/create-manage-account-groups.md) to associate with your Workspace.
   10. Click **Next**.
   11. **Review Status**.

       <figure><img src="/files/TEYhKjtvgFJHvVewmaDR" alt="gcp add workspace 3"><figcaption></figcaption></figure>

       Verify the **Account Details** of the GCP Workspace and the status checks for the **Security Capabilities and Permissions**. Ensure that all the selected security capabilities display a green **Enabled** icon.
   12. Click **Save and Close** to complete onboarding.

       After you sucessfully onboard your GCP Workspace on Prisma Cloud, you can view the account on the **Providers > Cloud Accounts** page.

       <figure><img src="/files/zcMFhX7xS6KpXaUucPo4" alt="gcp add workspace 4"><figcaption></figcaption></figure>

       If you encounter an issue with an onboarded account that displays a yellow or red cloud account **Status**, you have the option of reloading or refreshing the status of any onboarded cloud account and it’s associated security capabilities. Navigate to **Home > Settings > Providers > Cloud Accounts** and click on the Status of the cloud account you wish to refresh. Select the refresh button on the Status window to reload your cloud account.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-gcp/onboard-gcp-workspace.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.