Google Workspace organisation

Attach a whole Google Workspace so that every mailbox in its directory can be archived. A Workspace super administrator does this in two parts: authorising Mailgestor in the Google Admin console, then proving to Mailgestor that they control the domain.

How it works

Mailgestor owns one Google service account. You authorise that service account's client ID for domain-wide delegation in your Admin console, limited to read-only scopes. Mailgestor then reads the directory as the administrator you name, and each mailbox as its owner. No key leaves Mailgestor and nothing is installed in your Workspace.

The sign-in that follows asks only for the administrator's identity, not mailbox access. It proves the person attaching the domain controls an account in it.

Part 1: authorise the client ID

You need the client ID and scopes, which the app shows on the connection form. In the Google Admin console:

  1. Open Security, then Access and data control, then API controls.
  2. Choose Manage domain-wide delegation, then Add new.
  3. Enter the client ID shown in the app.
  4. Paste the scopes, comma separated. They are:
https://www.googleapis.com/auth/gmail.readonly,
https://www.googleapis.com/auth/calendar.readonly,
https://www.googleapis.com/auth/contacts.readonly,
https://www.googleapis.com/auth/drive.readonly,
https://www.googleapis.com/auth/admin.directory.user.readonly
  1. Authorise.

Every scope is read-only. The directory scope lets Mailgestor list the users; the Drive scope is for the Drive archive that is coming, listed now so the delegation need not be edited again when it arrives. Mailgestor reads no Drive files until you create a Drive job.

Part 2: connect in the app

  1. Open Connections, choose New connection, then Google Workspace organisation. Or pick it in the guided setup.
  2. Enter the email address of a super administrator to act as. Mailgestor reads the directory as this person.
  3. Give the connection a name if you like, then continue.
  4. Google opens and asks you to sign in as that administrator. This proves you control the domain.
  5. Mailgestor tests the delegation by listing the directory, then creates the connection with every mailbox it found.

If the test fails, the message says why. The usual causes are the scopes not yet saved in the Admin console, a typo in the client ID, or a few minutes of delay before Google applies the change.

Choosing mailboxes

When you create a job, the mailboxes come from the directory: every user, with their address and name. Tick the ones to archive. Suspended users are listed too, since leavers are usually suspended first.

Mailgestor measures each mailbox before the job can start. Gmail does not report a mailbox size directly, so the figure is the message count times a typical message size and is labelled an estimate.

Using your own service account

If your organisation would rather not authorise Mailgestor's service account, create your own in Google Cloud, give it a JSON key, authorise its client ID for the same scopes, and paste the key into the connection form under Use my own service account key. The key is stored encrypted under your account's key and used only for this connection.

Removing access

To withdraw Mailgestor's access, delete the client ID from Manage domain-wide delegation in the Admin console. Connections that use it show Revoked at the next check. Remove the connection in the app to delete the stored credential.