Google Gemini

Connect Google Gemini to 1Password SaaS Manager to track users and their license assignments, and to provision and deprovision access.

SaaS Manager connects to the Google Discovery Engine APIs using a Google Cloud service account.

Before you begin

To connect Google Gemini to SaaS Manager, you’ll need:

  • A Google Cloud project with a Gemini Enterprise subscription. This is also the project that holds your license configurations and user store.
  • Permission to create service accounts and grant IAM roles in that project (for example, the Owner or Project IAM Admin role). Learn more about roles in Google Cloud.

Step 1: Set up the API in Google Cloud

Sign in to the Google Cloud console and select the project that holds your Gemini Enterprise subscription, then follow these steps:

1.1: Enable the required APIs

Follow the steps to enable the required APIs for each of the following:

  • Discovery Engine API (discoveryengine.googleapis.com)
  • Cloud Resource Manager API (cloudresourcemanager.googleapis.com)

Tip

The Cloud Resource Manager API is only used for provisioning and deprovisioning. If you only want to track users and licenses, the Discovery Engine API is enough.

1.2: Create a custom role

Following the principle of least privilege, SaaS Manager only needs four permissions to track users and manage licenses.

  1. Create a custom role in Google Cloud.
  2. Name the role SaaS Manager license management.
  3. Grant the role the following permissions:
    • discoveryengine.licenseConfigs.list
    • discoveryengine.userStores.listUserLicenses
    • discoveryengine.userStores.batchUpdateUserLicenses
    • serviceusage.services.use

1.3: Create a service account and key

  1. Create a service account and name it 1Password SaaS Manager.
  2. Grant the account the following roles on the project:
    • SaaS Manager license management: The custom role you created in step 1.2.
    • Project IAM Admin (roles/resourcemanager.projectIamAdmin): Only needed for provisioning and deprovisioning. Skip this if you don’t plan to use provisioning workflows.
  3. Create a JSON key for the service account.
  4. Store the key file somewhere secure, like in a 1Password vault, and delete the downloaded copy after you finish connecting.

Step 2: Connect to SaaS Manager

Sign in to SaaS Manager, then follow these steps:

  1. Navigvate to Integrations > Google Gemini.
  2. Select Connect.
  3. Fill out the following fields:
    • Features: Choose the features you want to use.
    • Service account key JSON: Paste the full contents of the service account key JSON file.
    • Location: Choose the location where your Gemini Enterprise user store’s Discovery Engine is.
    • Project number: Enter the numeric ID for your Google Cloud project. Learn how to find your project number.
  4. Select Connect.

After you connect Google Gemini, SaaS Manager will import every user in the Gemini Enterprise user store. This includes users whose license is unassigned or blocked, who will be shown without a license plan.

Provisioning and deprovisioning

When you provision a user, SaaS Manager adds a user to the roles/cloudaicompanion.user, roles/discoveryengine.user, and roles/serviceusage.serviceUsageConsumer, then assigns the license plan from your access level or workflow.

When you change a user’s license, it only updates their license assignment. Removing a license leaves them unassigned in the user store and their IAM roles aren’t affected.

When you deprovision a user, those same IAM roles are removed, as well as the license, and the user is removed from the user store. Their Google Workspace account is not suspended or deleted.

Get help

If your project has more than one license configuration with the same subscription tier (for example, an active subscription alongside an expired free trial), each one will appear as a separate license plan. Check the license configuration IDs against your Gemini Enterprise admin console to tell them apart.

If SaaS Manager shows a “Permission denied” error when provisioning or deprovisioning, the service account is missing permission to read and set the project IAM policy. Grant it the Project IAM Admin (roles/resourcemanager.projectIamAdmin) role on the project, as described in step 1.3.

Learn more


Published: