Integrating Google Workspace

Integrating Google Workspace involves performing the following procedures:

To set up the Google Workspace Project
To set up Barracuda XDR Dashboard

Setting up the Google Workspace Project

When integrating Google Workspace, you must add a user to a role that has the privileges in the table below, or use Super Admin :

Administrator Console Privileges	Reports
Admin API Privileges	Organizational Units: Read Users: Read Groups: Read Schema Management: Schema Read License Management: License read Billing Management: Billing Read Domain Allow List Management: Domain Allow List Read Activity Rules: Read

To set up the Google Workspace Project

Log in to Google Admin Console.
Click Add a User and populate the user information.
NOTE Take note of the email address. You will need to share it with Barracuda XDR later.
Add that new user to either Super Admin or create a Custom Role that has Access to the Admin API Privileges as outlined in the table above.
NOTE This account cannot have two-factor authentication enforced on it.
Create a new Google Workspace Project.
Enter a Project Name and select the Parent Organization.
Navigate to Google Cloud Platform and click Go to Project Settings.
On the Left Navigation, click IAM & Admin > Service Accounts .
At the top of the screen, click Create Service Account.
Enter the Service account name and Description. The Service account id is generated. Click Create and Continue.
Click Continue.
In Service Account Users Role, enter the user account you created in Step 1, then click Done.
You will be brought to the project home page and you will see the service account you created.
To create a key, click the three dots under Action and click Manage Keys.
Click Add Key > Create new key .
Select JSON.

WARNING At this point, users may encounter a Service account key creation is disabled error. If you see this error, perform the following to enable service account creation, https://documentation.campus.barracuda.com/wiki/x/RYCGEw, then return and complete this procedure.
NOTE The .JSON file downloads automatically. Save this downloaded file. You must input it on the dashboard.
Navigate to https://console.cloud.google.com/apis/library. Ensure your project is selected. Search for Admin SDK API and click it.
If it is not enabled, enable it. When it is enabled, validate it.
Navigate to the OAuth consent screen menu.
To configure the Google Auth Platform, click Get started.
Enter the following:
- An application name, such as skt-gcp-monitor
- User support email
Click Next.
For the Audience, select Internal and click Next.
In the Contact Information section, type the Email address of any admin user and click Next.
Agree to the API Services User Data Policy and click Create.
Navigate to Data access.
Select Add or remove scopes, then click Filter and select Scope.
In the search box type: admin.reports.audit.readonly - press enter, then select the check box next to it.
Click Update, then at the bottom of the main Data Access menu click Save.
On the left navigation bar, click APIs and services, then click Credentials.
Select the associated Service account from the Service Accounts table.
On the Service Account page, under the Unique ID section, copy the Unique ID.
Navigate to Domain-wide Delegation (http://google.com ).
Click Add New and paste the Unique ID you just copied into the Client ID field.
Add https://www.googleapis.com/auth/admin.reports.audit.readonly to OAuth Scopes and click Authorize.

To set up Barracuda XDR Dashboard

In Barracuda XDR Dashboard, click Integrations .
On the Google Workspace card, click Setup.
Add the Credentials .JSON file that was generated/downloaded earlier, and the email for the user you granted the sufficient privileges.
Click Test and Save.