For clients on Google Workspace, SeatReaper reads each user (name, email, suspended or archived, when they last signed in, when the account was made) and the licenses assigned to each user. It never changes users, licenses or settings.
SeatReaper signs in with a service account that you create in your own Google Cloud project. SeatReaper does not own a key to anyone's domain. Each client's super admin decides whether that service account may read their domain, and can take the access back at any time.
1. Create the service account (once)
- Sign in to the Google Cloud console and create a project for SeatReaper (or use one you already have).
- Open APIs & Services > Library and turn on the Admin SDK API and the Enterprise License Manager API.
- Open IAM & Admin > Service accounts and choose Create service account. Give it a name such as "SeatReaper". It needs no roles in the project.
- Open the new service account, go to Keys > Add key > Create new key, choose JSON and download the file. Keep it somewhere safe; Google does not show the private key again.
- In SeatReaper, an owner opens Settings > Integrations > Google Workspace, pastes the whole JSON file and chooses Save service account. SeatReaper checks that Google accepts the key, then stores the private key encrypted.
The Google Workspace card then shows the service account's client ID and the two scopes the client's super admin needs.
If your Google Cloud organization blocks service account keys (the policy "Disable service account key creation"), an organization admin has to allow keys for this project first.
2. Give it access to each client's domain
A super admin of the client's Google Workspace does this once:
- In the client's Google Admin console, open Security > Access and data control > API controls.
- Under Domain-wide delegation, choose Manage domain-wide delegation > Add new.
- Paste the client ID from SeatReaper, and these two scopes as one line, separated by a comma:
https://www.googleapis.com/auth/admin.directory.user.readonlyhttps://www.googleapis.com/auth/apps.licensing
- Choose Authorize. Google can take a few minutes, sometimes longer, to apply it.
The first scope only reads users. The License Manager API has no read-only scope, so the second one would also allow license changes. SeatReaper only reads with it, and every request it makes is a read.
3. Add an admin email on the client's page
Domain-wide delegation lets the service account act as a person in the domain, so SeatReaper needs to know who. An owner or tech opens the client in SeatReaper, goes to Data sources > Google Workspace, enters the email of an admin who can see users and licenses (a super admin works), and chooses Connect Google Workspace. SeatReaper checks that it can read the domain as that admin.
Users show up after the next Google Workspace sync. SeatReaper syncs every day; owners and techs can also choose Sync Google Workspace now on the client's page or under Settings > Integrations. One sync reads every client with an admin email. If one client cannot be read, the others still are, and the reason shows on that client's page.
What SeatReaper flags
- Suspended, still licensed: a suspended user who still has a paid license. Google charges for suspended users, so suspending someone does not stop the cost. Delete the user, or move them to an Archived User license if their data must be kept.
- No sign-in for 90+ days, still licensed: a user who has not signed in for the inactivity threshold (the same one as Microsoft 365, under the price book) and still has a paid license. A user who has never signed in counts from the day the account was made, so new accounts are not flagged.
Archived users, Archived User licenses and users with no license are never flagged. Free Cloud Identity is not read.
Google's last sign-in time is the last time the person signed in, not the last time they used Gmail or Drive. Someone who stays signed in on a phone for months can look inactive. Check with the client before removing a license.
Each license gets a row in the price book so its monthly cost counts toward the savings. An item is confirmed as saved when you approved it and the next sync no longer finds that license on the person (or the person is gone).
Disconnect
- One client: choose Disconnect on the client's Google Workspace card. SeatReaper deletes that client's Google data. The client's super admin can also delete the delegation in their Admin console.
- Everything: an owner chooses Disconnect on the Google Workspace card under Settings > Integrations. SeatReaper deletes the key and every client's Google data. Delete the key in Google Cloud too, to revoke it completely.
In compliance reports
On Growth and Pro, the Access review in the compliance evidence reports lists Google Workspace accounts that are suspended or have not signed in for your inactive threshold.