Skip to main content
We use Google Workspace’s OAuth support to integrate into your Workspace account. The workspace integration requires directory read permissions to be able to look up all users in your organization.
To get started, add a new integration and select Google Workspace. You will be redirected to the OAuth Consent Page.

Allow-listing Wirespeed emails in the Google Admin Console

You can add certain domains and email addresses to an allow-list across your Google Workspace. To ensure Wirespeed emails get to your team:
  1. Sign in to the Google Admin Console at https://admin.google.com using an administrator account.
  2. In the left-hand menu, click Apps > Google Workspace > Gmail.
  3. Ensure your domain is selected in the Organizational Units section.
  4. On the Spam, Phishing, and Malware tab, locate the Spam section.
  5. Click Configure (if no rules exist) or Add another rule.
  6. Name your rule, and ensure the Bypass spam filters and hide warnings for messages from senders or domains in selected lists checkbox is checked.
The Bypass spam filters for internal senders checkbox may be checked by default. It’s NOT necessary to have this checked for our purposes and may add unwanted risk. Consider this before leaving it enabled.
  1. Click Create or edit list to open the Manage Address list page.
    • If creating a new list, click ADD ADDRESS LIST name it accordingly, and select Add Address.
    • If editing an existing list, select the list and click Add Address.
  2. In the field provided, enter the domain: wirespeed.co.
  3. Click SAVE.
  4. Return to the spam rule configuration page and click Use existing list and select the list you edited.
  5. Click Save to apply the changes.

What Events Are Collected?

Wirespeed reads Google Workspace activity from the Admin SDK Reports API with the read-only audit permission granted when you connect, and syncs your user directory. No additional setup is required in Wirespeed. Gemini and NotebookLM events appear only when those services are turned on in your Workspace. Gemini and NotebookLM collection turns on automatically when Google provides those audit logs, and Wirespeed rechecks availability every few hours. You do not need to reconnect the integration. If either source is unavailable, the integration shows a warning and the other sources keep working. Collection starts when a source becomes available; earlier history is not imported.

Managed Detections

Wirespeed evaluates the collected events for: Successful and failed sign-ins are also normalized as authentication events for SIEM searches and cross-platform login detections. Wirespeed does not create an individual detection for every sign-in.

Errors

access_not_configured

Access blocked: Your institution’s admin needs to review Wirespeed. Error 400: access_not_configured
This error occurs when your Google Workspace organization restricts third-party OAuth applications by default. This is a security feature in Google’s Admin Console that requires an administrator to explicitly approve applications before users can grant them access. To resolve this, a Google Workspace Super Admin must pre-approve the Wirespeed application:
  1. Sign in to the Google Admin Console as a Super Admin.
  2. Navigate to Security > Access and data control > API controls.
  3. Click Manage Third-Party App Access (or go directly to App Access Control).
  4. Click Add app > OAuth App Name Or Client ID.
  5. Search for Wirespeed or paste the OAuth Client ID provided by your Wirespeed administrator.
  6. Select the Wirespeed app and click Select.
  7. Set the access level to Trusted (recommended) or Limited.
  8. Click Configure to save.
Once the app has been approved, return to Wirespeed and retry the Google Workspace integration.
If you are unsure of the OAuth Client ID, contact your Wirespeed account representative or email support@wirespeed.co.

Integration fails with Limited access but works when Trusted

When Wirespeed’s access is set to Limited (or Specific Google data) in App Access Control, Google reports that your admin must grant additional permissions and the connection fails, even though every requested scope is allowed. Setting Wirespeed to Trusted makes the connection succeed. A known cause is that the account used to connect Wirespeed is enrolled in Google’s Advanced Protection Program. Advanced Protection restricts which third-party apps enrolled users can authorize, so an app with Limited or Specific Google data access can still be blocked. Marking the app as Trusted lifts that restriction. To resolve this without trusting Wirespeed:
  1. Create or choose a dedicated Super Admin account that is not enrolled in Advanced Protection, and use it only to grant consent. Without Advanced Protection, security-key sign-in is not enforced for this account, so place it in an organizational unit whose 2-Step Verification policy is enforced with Only security key as the allowed method.
  2. In App Access Control, set Wirespeed to the access level your policy allows, such as Limited or Specific Google data.
  3. Retry the Google Workspace integration. On the Google consent page, sign in with the dedicated Super Admin account.
If every account that can grant consent must stay enrolled in Advanced Protection, Wirespeed must remain Trusted in App Access Control.
The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.