Create a cloud action - Google Workspace (Chrome OS)

Create a Google Workspace (ChromeOS) cloud action to discover the ChromeOS devices managed in your Google Workspace tenant. Lansweeper lists these devices through the Google Admin SDK Directory API and maps them to the ChromeOS asset type, so your Chromebooks and other ChromeOS hardware stay visible in a unified inventory.

Authentication reuses the same Workload Identity Federation (WIF) setup as the Google Cloud Platform cloud action. There's no service account key file and no separate username or password. The service account also needs permission to read directory data in your Google Workspace tenant. You grant that access in one of two ways: domain-wide delegation, or by assigning an admin role to the service account.

Prerequisites

• A Google Workspace tenant that manages ChromeOS devices.
• Super Admin access to the Google Workspace Admin console (admin.google.com).
• A Google Cloud project where you can create a Workload Identity Pool and a service account. This can be the same project you use for the GCP cloud action.
• The Admin SDK API enabled in that project. In the Google Cloud console, go to APIs and Services > Library, search for Admin SDK API, and select Enable.
• Your Workload Identity Provider, Workload Identity Pool ID, Project Number, and Service Account Email from the WIF setup.
• The service account's numeric Client ID, if you use domain-wide delegation.

Set up Workload Identity Federation

ChromeOS uses the same WIF pool, provider, and service account as the GCP cloud action. Follow the Workload Identity Federation steps in Prepare Google Cloud Platform for Cloud Discovery: create the Workload Identity Pool and OIDC provider, create the service account, and grant the pool permission to impersonate the service account.

To use domain-wide delegation, you also need the service account's numeric Client ID. In the Google Cloud console, go to IAM and Admin > Service Accounts, select your service account, and open Advanced settings to find the Client ID.

Grant access to ChromeOS device data

The service account needs read access to the ChromeOS devices in your Google Workspace tenant. Both methods below use a single OAuth scope:

https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly

Choose one of the following methods.

Method A: Domain-wide delegation

With domain-wide delegation, the service account impersonates an admin user to read the directory. You provide an Admin Email in Lansweeper.

In the Google Workspace Admin console:

1. Sign in as a Super Admin.
2. Go to Menu > Security > Access and data control > API controls.
3. Under Domain wide delegation, select Manage Domain Wide Delegation.
4. Select Add new.
5. In Client ID, enter the service account's numeric client ID.
6. In OAuth scopes, enter https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly.
7. Select Authorize.

When you create the action in Lansweeper, select Domain-wide delegation as the authentication method and enter the Admin Email of a user in the tenant who can read ChromeOS devices, such as a Super Admin or a user granted that access.

Method B: Service account as admin

With this method, the service account is granted an admin role and reads the directory as itself, with no user impersonation. You provide a Customer ID in Lansweeper.

In the Google Workspace Admin console:

1. Sign in as a Super Admin.
2. Go to Menu > Account > Admin roles.
3. Select or create a role that grants read access to ChromeOS devices. A custom role with the ChromeOS device read privilege is enough. You don't need Super Admin, and it can't be assigned to a service account.
4. On that role, open the Actions menu and select Assign admin.
5. Select Assign service accounts.
6. Enter the service account email, select Add, then select Assign role.

When you create the action in Lansweeper, select Service account as admin as the authentication method and enter the Customer ID.

Create the ChromeOS cloud action

You create the action through a step-by-step wizard.

1. In your Lansweeper Site, go to Discovery > Actions.
2. Select Create action.
3. Select Cloud as the action type, and Google Workspace (Chrome OS) as the cloud source.
4. On the Action details step, enter a name and description, then continue.
5. On the Authentication step, select Set up new connection.
6. In the connection dialog, enter your Project Number, Workload Identity Pool ID, Workload Identity Provider, and Service Account Email.
7. Select the authentication method you set up in Google. The dialog then shows the field for that method:
   • For Domain-wide delegation, enter the Admin Email.
   • For Service account as admin, enter the Customer ID.
8. Select Test connection. When the test succeeds, the dialog closes and the connection shows as connected. A successful test confirms your credentials, scope, and access are correct.
9. Continue through the Filters and Define triggers steps to choose which devices to discover and set when the discovery runs.
10. On the Review step, check your settings and select Save and finish.

Field reference