---
title: "Create a ChromeOS cloud action | Lansweeper Platform"
slug: "create-a-cloud-action-google-workspace-chrome-os"
description: "Create a Google Workspace (ChromeOS) cloud action to discover ChromeOS devices in Lansweeper. Authenticate with Workload Identity Federation and the Admin SDK."
tags: ["Lansweeper Platform", "Discovery and scanning", "Cloud Discovery"]
status: "new"
updated: 2026-10-12T08:15:15Z
published: 2026-10-12T08:15:15Z
canonical: "docs.lansweeper.com/create-a-cloud-action-google-workspace-chrome-os"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lansweeper.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a cloud action - Google Workspace (Chrome OS)

Create a Google Workspace (ChromeOS) cloud action to discover the ChromeOS devices managed in your Google Workspace tenant. Lansweeper lists these devices through the Google Admin SDK Directory API and maps them to the ChromeOS asset type, so your Chromebooks and other ChromeOS hardware stay visible in a unified inventory.

Authentication reuses the same Workload Identity Federation (WIF) setup as the Google Cloud Platform cloud action. There's no service account key file and no separate username or password. The service account also needs permission to read directory data in your Google Workspace tenant. You grant that access in one of two ways: domain-wide delegation, or by assigning an admin role to the service account.

              Grant access with one method only

              

Set up either domain-wide delegation or service account as admin, not both. This choice determines whether you provide an **Admin Email** or a **Customer ID** when you create the action.

## Prerequisites

- A Google Workspace tenant that manages ChromeOS devices.
- Super Admin access to the Google Workspace Admin console (`admin.google.com`).
- A Google Cloud project where you can create a Workload Identity Pool and a service account. This can be the same project you use for the GCP cloud action.
- The Admin SDK API enabled in that project. In the Google Cloud console, go to **APIs and Services** > **Library**, search for **Admin SDK API**, and select **Enable**.
- Your **Workload Identity Provider**, **Workload Identity Pool ID**, **Project Number**, and **Service Account Email** from the WIF setup.
- The service account's numeric **Client ID**, if you use domain-wide delegation.

## Set up Workload Identity Federation

ChromeOS uses the same WIF pool, provider, and service account as the GCP cloud action. Follow the Workload Identity Federation steps in [Prepare Google Cloud Platform for Cloud Discovery](/v1/docs/prepare-google-cloud-platform-for-cloud-discovery): create the Workload Identity Pool and OIDC provider, create the service account, and grant the pool permission to impersonate the service account.

              ChromeOS skips the GCP viewer roles

              

ChromeOS reads Google Workspace directory data, not GCP resources. You don't need the Viewer, Folder Viewer, or Organization Viewer IAM roles from the GCP setup. You grant directory access in the next step instead.

To use domain-wide delegation, you also need the service account's numeric **Client ID**. In the Google Cloud console, go to **IAM and Admin** > **Service Accounts**, select your service account, and open **Advanced settings** to find the **Client ID**.

## Grant access to ChromeOS device data

The service account needs read access to the ChromeOS devices in your Google Workspace tenant. Both methods below use a single OAuth scope:

```
https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly
```

Choose one of the following methods.

### Method A: Domain-wide delegation

With domain-wide delegation, the service account impersonates an admin user to read the directory. You provide an **Admin Email** in Lansweeper.

In the Google Workspace Admin console:

1. Sign in as a Super Admin.
2. Go to **Menu** > **Security** > **Access and data control** > **API controls**.
3. Under **Domain wide delegation**, select **Manage Domain Wide Delegation**.
4. Select **Add new**.
5. In **Client ID**, enter the service account's numeric client ID.
6. In **OAuth scopes**, enter `https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly`.
7. Select **Authorize**.

              Authorization can take time to apply

              

Since August 2024, authorizing a new client ID for domain-wide delegation may need approval from a second Super Admin before it takes effect, depending on your Workspace edition and security settings. Changes can take up to 24 hours to propagate, though they're usually quicker.

When you create the action in Lansweeper, select **Domain-wide delegation** as the authentication method and enter the **Admin Email** of a user in the tenant who can read ChromeOS devices, such as a Super Admin or a user granted that access.

### Method B: Service account as admin

With this method, the service account is granted an admin role and reads the directory as itself, with no user impersonation. You provide a **Customer ID** in Lansweeper.

In the Google Workspace Admin console:

1. Sign in as a Super Admin.
2. Go to **Menu** > **Account** > **Admin roles**.
3. Select or create a role that grants read access to ChromeOS devices. A custom role with the ChromeOS device read privilege is enough. You don't need Super Admin, and it can't be assigned to a service account.
4. On that role, open the **Actions** menu and select **Assign admin**.
5. Select **Assign service accounts**.
6. Enter the service account email, select **Add**, then select **Assign role**.

              Customer ID is required for this method

              

The `my_customer` alias doesn't resolve for a service account, so you must supply your Google Workspace Customer ID. Find it in the Admin console under **Account** > **Account settings** > **Customer ID**. It starts with `C`, for example `C03az79cb`.

When you create the action in Lansweeper, select **Service account as admin** as the authentication method and enter the **Customer ID**.

## Create the ChromeOS cloud action

You create the action through a step-by-step wizard.

1. In your Lansweeper Site, go to **Discovery** > **Actions**.
2. Select **Create action**.
3. Select **Cloud** as the action type, and **Google Workspace (Chrome OS)** as the cloud source.
4. On the **Action details** step, enter a name and description, then continue.
5. On the **Authentication** step, select **Set up new connection**.
6. In the connection dialog, enter your **Project Number**, **Workload Identity Pool ID**, **Workload Identity Provider**, and **Service Account Email**.
7. Select the authentication method you set up in Google. The dialog then shows the field for that method:
  - For **Domain-wide delegation**, enter the **Admin Email**.
  - For **Service account as admin**, enter the **Customer ID**.
8. Select **Test connection**. When the test succeeds, the dialog closes and the connection shows as connected. A successful test confirms your credentials, scope, and access are correct.
9. Continue through the **Filters** and **Define triggers** steps to choose which devices to discover and set when the discovery runs.
10. On the **Review** step, check your settings and select **Save and finish**.

              Your method determines the required field

              

Domain-wide delegation requires an **Admin Email**. Service account as admin requires a **Customer ID**. Lansweeper validates the value when you test the connection and when you save the action.

### Field reference

| Field | Domain-wide delegation | Service account as admin |
| --- | --- | --- |
| Project Number | Required | Required |
| Workload Identity Pool ID | Required | Required |
| Workload Identity Provider | Required | Required |
| Service Account Email | Required | Required |
| Admin Email | Required | Not used |
| Customer ID | Not used | Required |