Integrations / Gemini for Google Workspace

Gemini for Google Workspace

Gemini for Google Workspace (formerly Duet AI) — per-user adoption via Google Workspace Admin Reports API. Tracks daily active users and feature usage (Docs, Gmail, Meet AI features) for AI seat governance.

OAuth 2.0

Spend

What Telara does

Capability matrix

Indexes No Tracks spend Yes Discovers shadow AI No Runs actions No Real-time events No

Before you connect

Prerequisites

A Google Workspace Business or Enterprise customer with Gemini for Workspace.

Super admin. Domain-wide delegation cannot be finished by a delegated admin who cannot open Security → API controls.

Vendor setup

Get the credential

Create a service account

In Google Cloud, IAM & Admin → Service Accounts → Create. Name it for Telara. Create a JSON key (Keys → Add key → JSON).

Enable domain-wide delegation

In Google Admin, go to Security → Access and data control → API controls → Domain-wide delegation → Add new. Paste the service account’s Client ID. Grant the permissions this page lists from the catalog. Impersonate a Workspace super admin.

Paste in Telara

Settings → Integrations → Gemini for Google Workspace. Upload the JSON key. Enter the Workspace customer id (or the literal my_customer) and the super-admin email the service account impersonates.

Permissions Telara requests

https://www.googleapis.com/auth/admin.reports.usage.readonly
OAuth 2.0

In Telara

Connect in Telara

OAuth 2.0

Google Workspace service account with domain-wide delegation. In the Google Admin console, grant the service account the OAuth scope https://www.googleapis.com/auth/admin.reports.usage.readonly via Security → API controls → Domain-wide delegation. Supply the full service account JSON key. Set customer_id to your Workspace customer ID or use the literal string 'my_customer' for the primary domain. admin_email is the Workspace super-admin the service account impersonates — the Admin SDK Reports API has no service-account-native identity and requires domain-wide-delegation impersonation of a real admin user.

In Telara, open Settings → Integrations, choose this connector, and click Connect. Telara sends you to the vendor to approve access, then returns you here. You do not create an OAuth app or paste a client secret.

Fields Telara asks for

Service Account Json
Customer Id
Admin Email

Spend

What gets measured

Resolution: Per user per day.

Attribution: Matched to people by email.

How far back vendor history goes is not published uniformly for this connector.

duet_ai_active_users
count
docs_ai_uses
count
gmail_ai_uses
count
meet_ai_uses
count
slides_ai_uses
count
sheets_ai_uses
count

Sync

Freshness & sync

Spend connectors refresh on the vendor pull cadence declared in the catalog. Indexing lag is not published for this connector.

Data handling

Permissions & data handling

The scopes above are the permissions this connector requests. They come from the catalog, not from a hand-written page.

This catalog entry does not declare extra semantic-search exclusions.

After connect

Verify it worked

After you save, Telara runs a read-only check against the account. The integration shows as connected when that check succeeds.

Honesty

Known limitations

The Admin SDK Reports API has no service-account-native identity. Skipping impersonation is the usual failed setup.

Gemini for Workspace usage lags Google’s reports pipeline. Same-day zeros are often delay, not a bad key.