You add a source connection to allow Google Workspace Migrate to read, convert, and transfer data from the Google Workspace source environment. You use a service account to add the source connection.
You don't have to create a new service account when you add a source connection. You can use the service account that you set up earlier. If you reuse a service account, complete steps 2–3.
If you want to create a new service account, follow steps 1–3.
Step 1: Create the service account (Optional)
How you create the account depends on whether you want to run an automated script (recommended) or to manually create a service account.
Option 1: Use an automated script to create the account (recommended)
- Follow the steps in Use an automated script to create the service account.
- Go to Step 3: Add a source connection for Google Workspace.
Option 2: Manually create account
Before you begin: Use a Google Cloud project belonging to either the source or target environment, depending on how you want to manage your API usage and quotas. You can create the new service account in a different Google Cloud project. If you do, first enable the APIs in the new project. For details, go to Step 1: Use Google Cloud to turn on APIs.
- In Google Cloud, click IAM & Admin
Service Accounts. You might have to click Menu
first.
- Click Create Service Account.
- For Service account name, enter a name.
The service account ID is completed automatically.
- (Optional) To add your own description to the service account, click Service account description and enter a description.
- Click Create and Continue.
- Service account and user permissions are not required for Google Workspace Migrate.
Click Done to skip these steps.
- Select the email address of the service account that you created.
- At the top, click Keys
- Make sure the key type is set to JSON and click Create.
You'll get a message that the service account JSON key file has been created and downloaded to your computer. Make a note of the name of this file because you’ll need it later.
- Click Close.
What happens next?
It can take up to 24 hours to create service accounts. If you lose the name of the key file, repeat these steps to create a new one.
Step 2: Authorize account
Next, authorize the service account in the Google Admin console for your source domain. You must complete this step even if you are reusing a service account.
-
Sign in to your Google Admin console.
Sign in using an account with super administrator privileges (does not end in @gmail.com).
-
In the Admin console, go to Menu
Security
You must be signed in as a super administrator for this task. -
Click Add new and enter your service account client ID.
You can find the ID (also known as the Unique ID) in the JSON file that you downloaded when you created the service account or in Google Cloud (click IAM & Admin
- For OAuth scopes, copy and paste the following scopes:
https://apps-apis.google.com/a/feeds/emailsettings/2.0/,
https://googleapis.com/auth/contacts,
https://googleapis.com/auth/admin.directory.group,
https://googleapis.com/auth/admin.directory.group.member,
https://googleapis.com/auth/admin.directory.orgunit,
https://googleapis.com/auth/admin.directory.resource.calendar,
https://googleapis.com/auth/admin.directory.user,
https://googleapis.com/auth/apps.groups.migration,
https://googleapis.com/auth/apps.groups.settings,
https://googleapis.com/auth/calendar,
https://googleapis.com/auth/drive,
https://googleapis.com/auth/drive.appdata,
https://googleapis.com/auth/drive.file,
https://googleapis.com/auth/gmail.modify,
https://googleapis.com/auth/migrate.deployment.interop,
https://googleapis.com/auth/tasks,
https://googleapis.com/auth/userinfo.email,
https://sites.google.com/feeds,
https://googleapis.com/auth/gmail.settings.basic,
https://googleapis.com/auth/gmail.settings.sharing,
https://googleapis.com/auth/admin.directory.customer.readonly,
https://googleapis.com/auth/admin.directory.rolemanagement.readonly - Click Authorize.
-
Point to the new client ID, click View details, and make sure that every scope is listed.
If a scope is not listed, click Edit, enter the missing scope, and click Authorize. You can't edit the client ID.
-
Go back to Google Cloud and click Save.
Troubleshoot
You might see the following error: Client is not authorized to retrieve access tokens using this method, or client not authorized for any of the scopes requested.
To troubleshoot:
- Repeat step 2 (Authorize the service account) above.
- Make sure you're using the correct client ID. Open the JSON file in a text editor to verify the client IDs match.
- If you still see the error, you might need to wait for the authorization process to finish. It usually takes a few minutes, but can take up to 24 hours.
Step 3: Add a source connection for Google Workspace
- In the Google Workspace Migrate platform, click New
- Under Name, enter a connection name.
- Under Type, select Google Workspace.
- Under Admin email, enter the email address of a super administrator for your source Google Workspace domain.
- Under Account, choose an option:
- Select an existing Google Workspace account, then move to step 8.
- Select Add a new account, then move to step 6.
- Locate the JSON key file for the Google service account on the source domain.
- Under Service certificate, click Upload file, navigate to the downloaded JSON private key, and click Open. Or, drag the JSON file to the box.
- Click Create.
Edit a connection
- In the Google Workspace Migrate platform, click Connections. You might have to click Menu
- Point to the connection and click More
- Enter your changes and click Save.
Next step
Create a sharding users list (Optional)
Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.