Your Google directory. Your Halo instance. In sync.
Halo's native Google Workspace integration syncs your user and agent directory into Halo automatically, lets your team sign in with their Google account, and keeps everything current as your organisation grows and changes.
✓ Google Sign-In (SSO)✓ Automated user & agent sync✓ Asset imports✓ Group-based access control✓ Halo Integrator — scheduled sync✓ Native — included in every licence
What you get
Four ways Google Workspace connects to Halo.
If your organisation runs Google Workspace, Halo's native integration uses it to handle identity, access, directory sync, and asset management — so your service desk stays current without manual administration.
Google Sign-In
Sign in to Halo with your Google account
Agents and end users authenticate to Halo using their existing Google Workspace credentials — the same login they use for Gmail, Drive, and Meet. No separate Halo password. No additional account to manage. Sign-in can be applied to agent logins, the self-service portal, or both.
✓Agents sign in to Halo with their Google account
✓End users access the self-service portal via Google
✓One identity for every Google tool — including Halo
Directory Sync
Users and agents stay in sync automatically
Halo uses the Halo Integrator to run a scheduled sync between your Google Workspace directory and Halo. New starters appear in Halo when they're added to your directory. Leavers lose access when their Google account is removed. No manual user management, no stale records.
✓Scheduled sync via Halo Integrator — runs automatically
✓New starters provisioned in Halo without manual admin
✓Leavers de-provisioned when their Google account is removed
Asset Imports
Devices from Google flow straight into Halo CMDB
Import managed devices — Chromebooks, mobiles, and other enrolled assets — from your Google Workspace directly into the Halo asset register. Field mappings, asset type rules, and site assignments keep the import structured and matched to your Halo configuration.
✓Chromebooks, mobiles, and enrolled devices imported automatically
✓Asset type rules determine how each device is categorised
✓Assets matched to users automatically by email or username
Access Control
Google groups control Halo roles automatically
Map Google Workspace groups to Halo agent roles. When an agent is added to a Google group, they receive the corresponding Halo role automatically on the next sync. When they're removed, the role is revoked. Your Google directory becomes the single source of truth for access control.
✓Google groups mapped to Halo roles and change advisory boards
✓Role changes in Google reflected in Halo on next sync
✓No manual role management — your directory is the authority
The detail
Everything the integration delivers.
The full feature set — active from day one, included in your Halo licence, no middleware, no extra subscriptions.
Agent Google Sign-In
Agents sign in to Halo using their Google Workspace identity. No separate Halo password — Google handles authentication end-to-end.
End user Sign-In
End users access the Halo self-service portal with the same Google credentials they use every day. Frictionless from the first visit.
Automated user sync
End users in Google Workspace are continuously synced into Halo via the Halo Integrator. Your Halo user list always reflects your actual directory.
Automated agent sync
Agents are provisioned and updated in Halo from your Google directory. Role changes in Google are reflected in Halo automatically on the next sync.
Automatic de-provisioning
When a user's Google account is removed or suspended, their Halo access is removed in the next sync cycle — no manual offboarding required.
Field mappings
Map Google Workspace user fields (name, department, manager, phone) to system and custom fields in Halo for both users and agents.
Site and agent mappings
Use filter profiles to map subsets of your Google directory to different sites or agent groups in Halo — essential for multi-site organisations.
Group → role mapping
Google Workspace groups are mapped to Halo agent roles and change advisory boards. Access is granted and revoked automatically as group membership changes.
Asset imports
Managed devices — Chromebooks, mobiles, enrolled hardware — are imported from Google into the Halo CMDB and assigned to users automatically.
New user onboarding tickets
Configure Halo to automatically log an onboarding ticket when a new user is imported for the first time — triggering your standard onboarding workflow.
Multi-tenant support
Connect multiple Google Workspace accounts to a single Halo instance. Each tenant is configured independently, with its own credentials, field mappings, and sync settings.
Included in the standard Halo licence
The full Google Workspace integration — directory sync, Google Sign-In, asset imports, group-based access — is included in the standard Halo licence. No add-on, connector, or middleware required.
Getting connected
How the integration is configured
Setup is handled from within Halo and your Google Cloud Console. No middleware, no third-party connectors, no software to install.
1
Create a project in Google Cloud Console
In your Google Cloud Console, create a new project for the Halo integration. This is where API access and OAuth credentials will be managed. A Google Workspace admin with Cloud Console access is required for this step.
2
Enable the Admin SDK API
Within the Google Cloud project, enable the Admin SDK API. This gives Halo the access it needs to read your Google Workspace directory — users, groups, and enrolled devices.
3
Configure the OAuth consent screen
Set up the Google Auth Platform for the project. Give the app a name and support email, and set the audience. For Google Sign-In (SSO) to work for all users, the audience must be set to External. Add test users initially — you'll publish the app once setup is verified.
4
Create an OAuth 2.0 client and get your credentials
Create a new Web Application OAuth client in Google Cloud Console. Add the redirect URI shown on the Halo Google Workspace setup page — this will be similar to https://YOURHALODOMAIN/authcallback for v2.200+ or https://auth.halocrm.io/externalauth for older versions. Google will issue a Client ID and Client Secret — copy both.
5
Enter the credentials in Halo and connect
In Halo, navigate to Configuration → Integrations → Identity Management → Google Workspace (or similar, depending on your version). Paste in the Client ID and Client Secret. Allow at least 5 minutes for the OAuth client to propagate before connecting — it can occasionally take a few hours. Authenticate using a Google account with read access to users and groups.
6
Configure site mappings, field mappings, and group rules
Set up site/agent mappings to control which Google users sync to which Halo sites or agent groups. Configure field mappings to bring across the right data. Add group-to-role mappings if you want Google group membership to control Halo access permissions.
7
Enable the Halo Integrator for ongoing automated sync
Once you're happy with the initial import, enable the Halo Integrator to keep users, agents, and assets in sync automatically on a schedule. Any change in your Google directory — new starters, leavers, device enrolments — will be reflected in Halo without any manual intervention.
Before you start
What you'll need to do in your Google environment
The Google Workspace integration requires activity inside your own Google Cloud Console before Halo can connect. These steps need a Google Workspace administrator — they can't be completed by Allied ESM on your behalf.
Google admin
Google Cloud Console access
A Google admin with access to Google Cloud Console is required to create the project, enable APIs, and generate OAuth credentials. Standard Workspace admin access is sufficient — no elevated cloud billing role is needed.
Google admin
Enable Admin SDK API
The Admin SDK API must be enabled on the Google Cloud project before Halo can read directory data. This is a one-time step done inside the project's API library.
Google admin
Approve third-party app access (if required)
If your Google Workspace admin console has third-party app access restricted, you'll need to approve the OAuth Client ID under API Controls → Manage Third Party Access before the connection will succeed. A common error if this is missed is an "App Blocked" screen during authentication.
Ongoing
Publish the OAuth app and manage the client secret
The OAuth app must be published (not left in test mode) once initial setup is verified — test user authorisation expires after 7 days. The Client Secret should also be recorded and managed; if it's regenerated it will need to be updated in Halo's integration settings to avoid the sync breaking.
IT team
Keep the Halo Integrator running
Automated directory and asset sync relies on the Halo Integrator running on schedule. This needs to be monitored — if it stops, new starters won't appear in Halo and leavers won't be removed until it restarts.
Real-world uses
Three ways this changes the day-to-day.
These are the most common ways organisations put the Google Workspace integration to work from go-live.
01
A new starter is ready in Halo before their first day
HR provisions the new starter in Google Workspace. The Halo Integrator picks them up on the next scheduled sync — their user record is created, they're assigned to the right site, and they can sign in to the self-service portal with their Google account on day one. No manual user creation, no IT tickets about access.
Google provisioned→Synced to Halo→Ready on day one
02
An agent signs in to Halo — no credentials to set up
A service desk agent navigates to the Halo login page and clicks "Sign in with Google." They authenticate with their existing Google account, pass through any security policies already in place, and land directly in their Halo queue. IT never had to create a separate Halo account or issue a password.
Sign in with Google→Authenticated→In Halo
03
A leaver loses Halo access the moment their account is removed
An employee leaves. IT suspends or removes their Google Workspace account. At the next integrator run, Halo removes their access automatically. No lingering active accounts, no need to de-provision in a second system, no audit risk from orphaned access. Google is the single source of truth.
Google suspended→Integrator runs→Halo access removed
Common questions
Frequently asked questions
Is the Google Workspace integration included in every Halo licence?
Yes. The full Google Workspace integration — directory sync, Google Sign-In, asset imports, and group-based access control — is a native, first-party Halo feature included in the standard licence. There is no middleware, no third-party connector, and no add-on subscription required.
Does Google Sign-In work for both agents and end users?
Yes. Google Sign-In can be configured for agent logins and end user access to the self-service portal independently. You can roll it out to agents first, then extend it to end users, or enable both at the same time.
What does the Halo Integrator do?
The Halo Integrator is Halo's built-in sync engine. Once enabled for Google Workspace, it runs on a schedule and automatically imports any changes from your Google directory — new users, updated records, removed accounts, device enrolments — into Halo. You choose which entities to sync (users, agents, assets) and the integrator handles the rest. The last sync date and any errors are visible inside Halo.
What Google admin access is needed to set this up?
You need a Google admin with access to Google Cloud Console to create the project, enable the Admin SDK API, and generate OAuth credentials. The account used to authenticate the integration must have read access to your directory's users and groups — your Google admin can confirm the appropriate permissions level for your setup.
Can we connect multiple Google Workspace accounts?
Yes. Halo supports multi-tenant Google Workspace connections. Each tenant is configured separately under the integration with its own credentials, site mappings, and field mappings. This is useful for MSPs or organisations with multiple Google Workspace domains that need to sync into a single Halo instance.
Can we import assets from Google Workspace?
Yes. Managed devices enrolled in Google Workspace — including Chromebooks and mobile devices — can be imported into the Halo asset register. You configure asset type rules and field mappings to control how each device is categorised, and Halo can automatically assign assets to the right user based on their email or username.
Does this work with HaloCRM as well as HaloITSM?
Yes. The Google Workspace integration is available across HaloITSM, HaloPSA, and HaloCRM. The setup process is identical across all three products — the only difference is the redirect URI used during OAuth configuration, which is displayed on the integration setup page in Halo.
We're already live on Halo — can we add Google Workspace without disruption?
Yes. The integration can be added to an existing live Halo environment. Allied ESM can scope and configure the full setup — OAuth credentials, field mappings, site mappings, and Halo Integrator configuration — without disrupting your current workflows. Contact us to discuss what's involved for your specific setup.
Ready to connect Halo to your Google Workspace?
Allied ESM can scope and configure the full Halo + Google Workspace integration — whether you're starting a new implementation or adding it to an existing environment. Talk to us to find out what's involved.