Skip to main content

Google Discovery

Google Discovery connects Google Workspace to XFA. XFA reads your Google Workspace authentication logs and device data to find the devices used for work in your organization, so you can report on them and later reach them with Awareness or Enforcement.

Start the Google connection

  1. In the XFA dashboard, open Discovery.
  2. Click Add connection, or New if you already have a connection.
  3. Choose Discover devices in Google and click Continue.
Get started with device discovery

Each Discovery connection counts toward your plan's limit. If you have reached it, XFA shows Discovery connection limit reached. Upgrade your plan or remove a connection to continue.

Connect the Mobile Devices API

Click Connect and complete the Google sign-in and consent screen with an account that can authorize access for your organization. This gives XFA access to iOS and Android device data.

Grant XFA access to the Cloud Identity API

Set up domain-wide delegation so XFA can read all devices through the Cloud Identity API.

  1. Click Open Domain-wide Delegation page to open it in the Google Cloud Console.

  2. Click Add new.

  3. Fill in these values. The wizard has a copy button next to each one.

    FieldValue
    Client ID107563464460134163966
    Scopehttps://www.googleapis.com/auth/cloud-identity.devices

  4. Click Authorize.

  5. Back in XFA, tick I have set up Domain-wide Delegation in the Google Admin console. The next step stays locked until you do.

Select the devices XFA needs to discover

Choose which devices XFA imports:

  • Discover all devices imports every device found in your authentication logs.
  • Only discover devices from selected groups imports devices for the groups you pick in the group selector.

To leave out a device type, tick Exclude desktop devices or Exclude mobile devices.

Click Start discovery. The first devices appear on the Devices page as XFA finds them.

Adjust scoping later

To change the scope after setup, open Discovery and click Manage on your Google connection. Besides the device type filters, this page has two more options:

  • Only unmanaged devices skips devices that Google already marks as managed, for example by Google Endpoint Management.
  • Filter by groups limits Discovery to Only specific groups, or leaves out groups with Exclude groups. If a group is both included and excluded, it is excluded.

If mobile devices do not show up, check that Endpoint verification is set to at least Basic in the Google Workspace Admin console. Without it, Google does not record session data from mobile devices.