Overview
This template produces a Google Workspace Tenant Migration Assessment that provides information about your Google tenant environment including mailboxes, Google drive and shared drives, groups, domains, org units etc.
This is useful in the following use cases:
- Google tenant to tenant pre-migration assessment providing information about the source tenant.
- Generate purpose Google tenant reporting.
How it works
This template will retrieve data across your Google tenant to generate a report detailing the following information
- User and resource mailboxes including suspended mailboxes
- Google drive including drives associated with suspended accounts
- Shared drives
- Google groups (collaborative and non-collaborative)
- Holds and Matters
- Tenant Domains
- Organizational units
- Admin users
Requirements
To run this report, you will need to setup a Google Project, enable APIs for a Service Account and then set up scopes. To do this, complete the following steps
Create a project and enable APIs
-
Log into the Google Cloud Platform (GCP) Console and sign in as a super administrator.
-
Under the section Dashboard, click on Create Project. If the button Create Project doesn’t exist, click on the dropdown next to an existing project, then click on New Project
-
Provide the project a name (for example, Voleer Google Report), then click Create
-
Once the project is created, click on Enable APIs and Services
-
Type in Admin SDK API in the search box, then hit Enter. Click on the result labelled Admin SDK API
-
Click on the button Enable
-
Click on the APIs & Services breadcrumb along the top left hand side to get back to the Dashboard page to continue adding APIs
-
Repeat steps 5 - 7 for the following APIs
– G Suite Vault API
– Gmail API
– Google Drive API
– Cloud Identity
– Groups Settings API
– Google People API
Create Service Account
-
Log into Google Cloud Platform IAM & Admin and sign in as a super administrator.
-
Select the project created above
-
Click on + Create Service Account
-
Provide a service account name and description. Then click on Create and Continue
-
Select the role of Owner, then click on Continue and finish creating the service account by clicking on Done. You will return to the Service accounts page. Make note of the newly created service account email address as you will be required to input this when running the Voleer template
-
On the Service accounts page, click on the vertical ellipsis under the Actions column for the newly created service account. Click on Manage keys
-
Click on Add Key → Create new key and select key type P12. Click Create
-
The key file will be downloaded onto your machine. Keep track of this file as it will be uploaded into Voleer later.
-
Navigate back to the service account back clicking on Service Accounts on the left hand menu
-
Find the Unique ID field for that service account by clicking the Column Display Options button in the right upper corner above Actions and selecting Unique ID.
-
Copy the Unique ID for later use
Setting the scopes
-
Go to Domain Wide Delegation and sign in as a super administrator
-
Click on Add new
-
Paste in the Unique ID from step 11 above, then paste in the following text within the OAuth scopes (comma-delimited) field
https://www.googleapis.com/auth/admin.directory.customer.readonly,
https://www.googleapis.com/auth/admin.directory.domain.readonly,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/admin.directory.orgunit.readonly,
https://www.googleapis.com/auth/admin.directory.resource.calendar.readonly,
https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,
https://www.googleapis.com/auth/admin.directory.user.readonly,
https://www.googleapis.com/auth/admin.reports.usage.readonly,
https://www.googleapis.com/auth/apps.groups.settings,
https://www.googleapis.com/auth/cloud-identity.groups.readonly,
https://www.googleapis.com/auth/contacts.readonly,
https://www.googleapis.com/auth/drive.readonly,
https://www.googleapis.com/auth/ediscovery.readonly,
https://www.googleapis.com/auth/gmail.readonly
- Click Authorize
Getting Started
To start using this template, perform the following:
- Sign in to your Voleer account or sign up for a new account
- Find and click on the tile labelled Google Workspace Tenant Migration Assessment template from the list of templates within the library
- Select a workspace from the dropdown and click on Launch
- Select Save a new integration from the Google Service Account Integration
- Provide a name and a description. Note - for ease of management, name the integration the Google tenant name
- For Service account email, enter the email from step 5 in Create Service Account above. for *Service account .p12 file, upload the file from step 8 in Create Service Account. For Admin account email, provide the email address of the admin account of the Google tenant. Click on Submit
- Click on Close
- Select the newly created integration from the Google Service Account Integration dropdown, then Submit
- Configure the template by provide the recipient email address, then click on Validate Template Configuration
- Validate the details of the configuration and then click on Execute . Note - if the configuration is incorrect, cancel the run and start a new instance