Skip to main content
Opal’s integration with Google Groups supports the following, and more:
  • Users can request time-bounded access to your Google groups.
  • Auditors can initiate access reviews that assign managers or group admins to periodically review users with long-lived access to Google groups.
  • Admins can add resources from other Opal integrations to an Google group so an Google group’s members can automatically gain birthright access to, for example, a GitHub repo, AWS IAM role, etc.
  • All access changes are tracked in a permanent audit log that can be logged to a Slack channel or exported to your favorite tools.

Create a Google Groups app

To get started, go to the Inventory page, and click + App. Then, click on the Google Groups tile. 2312 You will see a form to be completed. Opal requires the following credentials in order to manage your Google Groups.

1. Configure a service account for Opal

For Opal to manage your Google Groups on your behalf, you’ll need a Google service account with proper permission scopes to retrieve metadata, such as group name and description, as well as to update the group. Follow the instructions for creating a service account if you haven’t already, and ensure it is granted the following scope:
If you only want to view user’s access to groups and not grant/revoke them, then you can use the admin.directory.group.readonly scope.

2. Create Opal Google Group

Create an Opal Google Group. We will use this Google Group’s domain to import groups during syncs.

3. Fill out Opal form

Back in Opal, fill in details about your Google Groups service account:
  • For Opal group email, enter the email of the Google group created in Step 2.
  • For Google Workspace admin email, enter the email of someone in your organization with admin privileges.
  • For domain, optionally enter the domain of the Google Workspace. If your Google Workspace has multiple domains, Google Groups will only import Google Groups associated with the domain you enter. By default, if this is not filled out, it is the domain of the Google Workspace admin email. Then, click to upload the downloaded JSON file for the created service account.
If this step is successful, you’ve completed setting up the Google Groups app.

Optional: Enable native Google Groups nesting

Google groups can contain other Google groups. By default, Opal flattens nested groups into user memberships. With native nesting, Opal keeps the group-in-group relationships as they exist in Google. Opal can also add and remove member groups in Google.
Native nesting can only be enabled when you create the Google Groups app. You can’t turn it on or off for an existing app. To use native nesting for an existing Google Workspace, create a new Google Groups app.
To enable it:
  • Contact Opal to enable native Google Groups nesting for your organization. The option is hidden until it’s enabled.
  • On the Google Groups app creation form, turn on Enable native Google Groups nesting.
  • Complete the rest of the form and save the app.
Apps created without this setting keep the flattened behavior. Opal shows the setting as Google Groups Native Nesting Enabled on the app’s Setup tab, where it’s read-only.

3. Import Google groups into Opal

You can import your Google groups into Opal manually or automatically. Note: Opal does not currently support syncing entire Organizational Units (OUs) or OU sub trees.

Manual import

You can use the Opal UI to manually select which Google Groups to import into Opal. To do this, on the app’s Assets tab, select Import assets and then select your groups. 2312 2312 This will query Google Groups to list all groups in your account. From here, you can select which Google Groups you’d like to import into Opal.

Automatic import

You can configure your Google Groups to be auto-imported into Opal each time the Google Groups app is synced. To automatically import your groups from Google Groups:
  • In Google Groups, create a Google group called Opal. Any groups that you add as members of this group will automatically be imported into Opal.
  • In Opal, navigate to Inventory > Google Groups App
  • Click the Edit button on the top right, then under Import Settings, toggle the setting to Auto-import tagged.
2312
Last modified on November 9, 2026