Integrating with Google Workspace

Integrating your Software Asset Management application with the Google Workspace service enables you to track your software subscriptions and to reclaim unused licenses.

For additional information about the Google Workspace service, see Google Workspace Admin Help.

Important: Minimize security risks and protect information by granting access only to the necessary user or API permissions.

Create a Google Workspace project

Create a project in the Google API Console.

Before you begin

Google Workspace Role required: Refer to the Minimal user permissions table.

Procedure

1. Log in to Google API Console.

2. Select Select a project > New Project.

3. Enter a name for your project in the Project name field, then select your Organization and Location.

4. Select Create.

5. Select OAuth consent screen on the side navigation menu.

6. If you haven't configured Google Auth Platform yet, select Get started.

7. Enter the App name and select User support email in the App information section.

8. Select Next.

9. In the Audience section, select Internal as the user type and select Next.

10. In Authorized domains, select the ADD DOMAIN button and add service-now.com.

11. Enter your email address in the Developer contact information section.

12. Select Save and Continue to add scopes.

13. On the Scopes page, select the Add or Remove Scopes button.

14. In the Manually add scopes section, enter the following scopes by pasting them to the text area:

    • https://www.googleapis.com/auth/apps.licensing
    • https://www.googleapis.com/auth/admin.directory.user
    • https://www.googleapis.com/auth/admin.directory.user.readonly
    • https://www.googleapis.com/auth/admin.directory.domain.readonly
    • https://www.googleapis.com/auth/admin.datatransfer
    • https://www.googleapis.com/auth/admin.datatransfer.readonly
    • https://www.googleapis.com/auth/admin.reports.usage.readonly
    • https://www.googleapis.com/auth/userinfo.profile
    • https://www.googleapis.com/auth/userinfo.email
    • Select ADD TO TABLE and then select Update.

15. Select Save and Continue.

16. Select Credentials on the side navigation menu and select CREATE CREDENTIALS.

17. Select OAuth client ID.

18. Fill out the form as shown and select Create.

1. Select OK.

   You can now view your client ID and client secret that you would use in your ServiceNow instance.

   Note: Your client ID and client secret are sensitive. Don't share them.

2. Select Library on the side navigation menu.

   Search for and enable the following APIs:

   • Enterprise License Manager API
   • Admin SDK
   • Google People API

Create a Google Workspace integration profile

Create an integration profile to track software subscriptions and optimize licensing for the Google Workspace service.

Before you begin

To create a Google Workspace integration profile, request the Software Asset Management - SaaS License Management plugin (sn_sam_saas_int) from the ServiceNow Store.

ServiceNow Role required: sam_integrator

About this task

If you’re using Software Asset Workspace, the option to create the Google Workspace integration profile in Core UI is inactive.

Procedure

1. Navigate to the integration profile.

1. On the form, fill in the fields.

   Field	Value
   Display name	Name of the integration profile. For example, Google Workspace Integration
   Client Id	Client ID for the OAuth application created in the SaaS admin account.
   Redirect url	URL of the OAuth provider that you're redirected to after authentication. This value is automatically populated.
   Client secret	Password associated with the client ID.
   Profile type	Type of integration profile. This value is automatically set to Google Workspace Subscription.

2. In the Process configuration section, review the required user roles or API permissions specified in the Vendor configuration field for each process to minimize security risks and optimize SaaS licenses.

   Note: For more information about the required roles and scopes, see Minimal user permissions table.

   • The Download subscriptions check box is selected by default and you can't clear it.

   • The Download Activity check box is selected by default. If you clear it, the activity scheduled job SAM - Refresh <displayname> Events isn't created.

     In the Analyze user activity field, you can also select the date and time starting from when you want to analyze the user activity. By default, you can analyze user activity up to 60 days prior to the current date and view events performed by individual users from the time you create this profile.

     Note: Software Asset Management pulls the events from the time that you start analyzing user activity irrespective of the profile creation date.

     You can modify this value in the Last activity threshold field of your software reclamation rules. For more information, see Review a software reclamation rule.

   • The Reclaim subscriptions check box is selected by default. If you don't want to reclaim subscriptions, you can clear this check box. If you clear it, the removal candidates are created but the reclaim subscription subflow isn't triggered or the reclamation process isn't initiated.

3. Select Submit after completing all the required fields.

   Your ServiceNow instance creates a draft integration profile.

4. On the integration profile, select Get OAuth Token.

   Note: For the role required to perform this step, refer to the Minimal user permissions table.

5. In the pop-up window, select your Google admin account and select Allow.

   Note: When user subscriptions are reclaimed, files from the reclaimed accounts are transferred to the admin account selected in this step. This account can be a different admin account than the one used to set up the integration. If you have to start transferring files to a new admin, you can select the Get OAuth Token related link again at any time to select a different admin account. After selecting a new admin, you can reclaim the old admin account to transfer all of their files to the new admin, including all previously reclaimed user files.

6. On the integration profile form, select Validate Connection to verify the connection and credential details of this integration.

   Validating the connection verifies the Download Subscriptions and Calculate Activity APIs, but not the Reclaim Subscriptions APIs.

   Note: If you clear the Download Activity check box after the integration profile is validated and scheduled jobs are created, you must revalidate the connections because the following events occur:

   • The Status field on the integration profile form changes to Draft.
   • The Validate connection button shows up on the form.
   • The current SAM - Refresh <displayname> Events job gets deleted.

Result

You can view events performed by individual users up to one year prior to the current date. For more information, see Review a software reclamation rule. Software Asset Management pulls the events from the time that you start downloading user subscriptions irrespective of the profile creation date.

What to do next

After the integration connects, your ServiceNow instance automatically creates software models, reclamation rules, and software subscriptions that are refreshed daily.

After creating an integration profile, view information about the profile in the Software Asset Workspace by navigating to License operations > User subscription > Direct integration profiles. You can select an integration profile to view the following related lists. If all of the following related lists aren't visible for an integration profile in the default view, you can select the custom integration view from the Details tab:

• Software Models
• Unrecognized Subscription Identifiers
• Scheduled Jobs
• Scheduled Job Results
• Software Subscriptions
• Subscription Identifier Exclusion Rule
• Subscription User Exclusion Rule

After creating an integration profile, you can define subscription exclusion rules to keep certain subscriptions from license cost calculations. For more information, see Subscription exclusions for SaaS and SSO applications.

If you want to set up multiple integration profiles with unique connections, create child aliases to manage different configurations and settings for each integration profile. For more information, see Create a child alias to set up multiple integration profiles.

Review all automatically generated reclamation rules to reclaim user subscriptions. For more information, see Review a software reclamation rule.

Create software entitlements for the automatically generated software models to track used software against owned software.

• For more information on creating software entitlements in the Software Asset Management Core UI, see Create entitlements in Software Asset Management Core UI.
• For more information on creating software entitlements in the Software Asset Workspace, see Create entitlements in workspace.
• For more information on creating software entitlements using the Software Asset Management Playbook, see Create entitlements using the guided walk-through.

Reconciliation also runs on your subscriptions as a scheduled job or on-demand. You can view your reconciliation results in the License Workbench (Software Asset Management classic application) or the License usage view (Software Asset Workspace). Use these results to determine your license compliance position and to remediate any non-compliance.

• For more information on running reconciliation in the Software Asset Management classic application, see Run software reconciliation in Software Asset Management classic.
• For more information on running reconciliation in the Software Asset Workspace, see Run software reconciliation in the workspace.