Google Directory Sync

​

Overview

​

Features

• User provisioning — Users in your Google Workspace directory are automatically added as members in Rootly, including first name, last name, email, and phone numbers.
• User deprovisioning — Users who are suspended or deleted in Google Workspace are automatically removed from Rootly.
• Group sync — Selectively sync Google Groups to Rootly Groups, keeping membership up to date.
• Role assignment — Assign Rootly roles based on Google Group membership.
• Phone number sync — Google Workspace phone numbers are synced to Rootly, critical for on-call routing.
• Periodic polling — Automatic sync runs approximately every 30 minutes to detect changes.
• Manual sync — Trigger an immediate sync from the Rootly dashboard at any time.
• Audit logging — All sync operations (users added, removed, updated, groups changed) are logged.
• Mass deletion safeguard — Prevents accidental mass deprovisioning if partial API results are returned.

​

Requirements

• A Google Workspace account with admin access
• One of the following authentication methods:
  • OAuth consent flow — Recommended for smaller organizations. Uses a familiar Google sign-in flow.
  • Service account with domain-wide delegation — Recommended for enterprise organizations with strict admin policies.

​

Setup

​

Option A: OAuth Authentication

1. Navigate to Integrations in your Rootly dashboard.
2. Find Google Directory Sync and click Connect.
3. Click Sign in with Google to initiate the OAuth consent flow.
4. Sign in with a Google Workspace admin account and grant the requested permissions:
   • admin.directory.user.readonly — Read user directory
   • admin.directory.group.readonly — Read group directory
   • admin.directory.group.member.readonly — Read group memberships
5. Once authorized, you’ll be redirected back to Rootly with the integration connected.

​

Option B: Service Account Authentication

1. Create a service account in Google Cloud Console:
   • Navigate to IAM & Admin > Service Accounts.
   • Click Create Service Account, give it a name (e.g., rootly-directory-sync).
   • Click Done (no additional roles needed at the project level).
   • Click on the created service account, go to Keys > Add Key > Create new key > JSON.
   • Download the JSON key file.
2. Enable domain-wide delegation:
   • In the service account details, click Show Advanced Settings.
   • Copy the Client ID.
   • In Google Admin Console, navigate to Security > Access and data control > API controls > Domain-wide delegation.
   • Click Add new and enter the Client ID.
   • Add the following OAuth scopes:
     Copy

     Ask AI

     https://www.googleapis.com/auth/admin.directory.user.readonly
     https://www.googleapis.com/auth/admin.directory.group.readonly
     https://www.googleapis.com/auth/admin.directory.group.member.readonly
     
   • Click Authorize.
3. Configure in Rootly:
   • Navigate to Integrations > Google Directory Sync.
   • Select Service Account as the authentication method.
   • Upload the JSON key file.
   • Enter the impersonation email — this must be a Google Workspace admin user’s email address that the service account will impersonate.
   • Click Save and Test Connection to validate credentials.

​

Configuring Sync

​

User Sync

• Create memberships for new users found in Google Workspace.
• Update user attributes (name, email, phone numbers) when they change.
• Remove memberships when users are suspended or deleted in Google Workspace.

​

Group Sync

1. Navigate to Integrations > Google Directory Sync in your Rootly dashboard.
2. Click the Groups tab.
3. Choose to either select specific groups or sync all groups from your directory.
4. If selecting specific groups, use the search box to find groups by name, then check the ones you want to sync.
5. Click Save.

​

Role Assignment

1. Under the Group Sync section, find the group you want to configure.
2. Select a Rootly Role to assign to members of this group.
3. Optionally select an On-Call Role for on-call scheduling.
4. Members added to the Google Group will automatically receive the assigned roles in Rootly.

​

Sync Status & Monitoring

​

Manual Sync

​

Audit Logs

• Timestamp
• Operation type (user created, user removed, group updated, etc.)
• Affected user or group
• Success or error status

​

Troubleshooting

​

Common Issues

​

Getting Help