Google Workspace Integration

Google Workspace Sync

K12Panel can connect to Google Workspace, Google Workspace for Education, and Google Workspace for Nonprofits to import your People, your organizational unit (OU) hierarchy, and your Chromebooks (as Assets). It is one of the most powerful ways to populate K12Panel automatically.

What gets imported

People — your Google users become People in K12Panel, so you can check Assets in and out to them and target them with Person-scoped Modifiers.
OU hierarchy — your Google OUs are mirrored in K12Panel and used to organize People.
Chromebooks — ChromeOS devices are imported as Assets into the Asset Class you designate as the ChromeOS Sync Default. New Chromebooks first appear on the On-Ramp for adoption.

K12Panel will not sync anything until you explicitly grant it permission.

Granting Authorization

Authorization is performed by a K12Panel administrator who also has the necessary rights in Google Workspace. A Google Workspace Super Admin is typically used, though that exact role is not strictly required.

Open the Cloud Sync tab in Settings while logged in as the Google Workspace user who can authorize the action.
Click Authorize Panel to Perform Google Workspace Sync.
K12Panel reminds you that the request is read-only, then redirects you to Google for final authorization.
At Google, approve the requested permissions. Every permission is a view-only scope — K12Panel cannot make changes in your Google Workspace.
On first authorization, an initial sync begins automatically.

After the initial sync, Cloud Syncs run several times throughout the day on a schedule. You can request an immediate run with Request Immediate Cloud Sync Refresh.

About security and passwords

No passwords are ever stored in K12Panel. Authorization is a token granted by your Google Workspace administrator, and it is re-verified through the Google API every time it is used. Your Google Workspace retains full control and can revoke access at any time.

Revoking Authorization

From within K12Panel

Use the De-Authorize Panel to Perform Google Workspace Sync button on the Cloud Sync tab to remove the authorization.

Directly from Google

Sign in to any Google service and go to myaccount.google.com.
Select Security, then scroll to third-party apps with account access.
Open Managed third-party access, find K12Panel, and revoke as you see fit.

If you revoke access, no further synchronizations can run until you re-authorize K12Panel.

Using Google and Microsoft Azure Together

If you sync with both clouds, Google synchronizes first and Microsoft Azure second. Because Azure runs second, any differences in People data from Azure overwrite the values imported from Google.

For example, if a person is bob@example.com named “Robert Smith” in Google and “Bob Smith” in Azure, K12Panel displays “Bob Smith.” People are merged across the two clouds by email address, so a person present in both must be removed from both before they will be removed from K12Panel.

If sign-in or sync stops working with an “Access blocked: your institution’s admin needs to review Panel” message, see the FAQ article on that error.
To get accurate Chromebook locations, deploy the ChromeOS extension (see the ChromeOS Extension article).

Common Questions

Does Google sync change anything in my Google Workspace?
No. K12Panel requests view-only scopes and cannot make any changes in Google.

Are any passwords stored in K12Panel?
No. Authorization is a revocable token; no passwords are ever stored.

How often does Google sync run?
Several times a day on a schedule. Use Request Immediate Cloud Sync Refresh to run it now.

Why are my Chromebooks showing the wrong location?
Deploy the ChromeOS extension; Chromebooks report location only after it runs.

I sync both Google and Azure - whose data wins?
Azure runs second, so its People values overwrite the matching Google values.

How do I stop syncing?
De-authorize in the Cloud Sync tab, or remove K12Panel's access in your Google account security settings.