Productivity integration
2-Step Verification coverage, admin inventory, and wasted Google seats — read-only, right next to your Microsoft tenants.
What Vectis syncs
Vectis reads each connected Google tenant's posture in a single Directory pass: who can sign in (and who's suspended, archived, or hasn't signed in for ages), whether each active user has 2-Step Verification, and who holds super-admin or delegated-admin rights — flagging any admin without a second factor first. License waste comes from the Enterprise License Manager (suspended/archived or dormant licensed seats), and an optional 7-day sign-in roll-up surfaces failed and suspicious logins if you authorize the reports scope. Every scope Vectis requests is read-only.
What you can do
Google Workspace is a read-only connector — Vectis never changes a setting, suspends a user, or unassigns a license. The value is correlation: open a customer and see 2-Step Verification coverage, admins missing a second factor, and wasted seats in the same posture view as your Microsoft tenants, and reclaim Google seats from the same Money Found surface that catches Microsoft and Pax8 leakage. The dedicated Google Workspace page rolls 2SV coverage, admins without 2SV, reclaimable seats, and suspicious sign-ins across every connected tenant — and only appears once at least one Google tenant is connected.
Honest about the limits
Google's Admin SDK doesn't expose a Secure Score, a Conditional Access policy model, or the same MFA telemetry Microsoft Graph does — so Vectis deliberately doesn't claim those surfaces for Google. Every number on a Google card is backed by a real Admin SDK field. The license-waste cost is labeled seat-only until a Google subscription price is on file to dollarize it, and the sign-in-security roll-up only appears if you authorize the (optional) reports scope; the core directory, 2-Step Verification, and privileged-account surfaces work without it.
How it correlates
Google Workspace on the customer account hub alongside every other system you run — not a standalone dashboard. A few of the most common shapes this takes:
A mixed-stack book stops meaning two consoles. Google 2-Step Verification coverage, admins without a second factor, and reclaimable seats land in the same security-posture view as your Microsoft 365 tenants — the MFA gap reads the same whether the tenant is on Google or Microsoft.
Suspended, archived, or long-dormant licensed Google users surface as reclaimable seats. When a Google subscription price is on file (e.g. via Pax8), the figure is in dollars; until then it's labeled seat-only — Vectis never invents a price.
Setup snapshot
Vectis authenticates with one Google service account via domain-wide delegation — the same mechanism Workspace backup and security tools use to onboard. There's no OAuth consent screen, no annual verification, no token that expires, and no per-tenant secret stored in Vectis. In the customer's Google Admin console under Security → Access and data control → API controls → Domain-wide delegation, a super-admin clicks Add new, pastes Vectis's service-account client ID, and pastes the read-only scope list (Vectis shows both, with copy buttons, in the Connect dialog). Back in Vectis, enter the tenant's primary domain and a super-admin email for Vectis to read as, then Verify & connect — Vectis confirms the delegation is in place, resolves the immutable org id, and starts syncing. You can omit the licensing or reports scope and the core surfaces still work; the matching card simply doesn't appear until that scope is authorized.
# In the Vectis hub, add the connector:
category Productivity
vendor Google Workspace
status Read-onlyOther Productivity integrations
Pricing
Google Workspace is available on every Vectis tier — $299/mo and up. See pricing
Also reachable over MCP — bring your own client → /mcp
