Integrate Kisi with Google Workspace Directory
Customers who don't yet have SSO set up can still import users from their Google Workspace Directory by manually setting up the integration. We recommend, however, setting up SSO to allow your Kisi users to log in with their single, existing credentials.
Kisi organizations are limited to one SSO and one SCIM integration. Depending on your needs, you can combine SSO and SCIM integrations with one or more user directory integrations within the same Kisi organization.
Prerequisites
- Kisi organization owner account
- Google Workspace administrator account
- a Google Workspace Directory setup with at least one organization unit
- User import integrations can only be done on organization level. This means, you can only import users into organization groups, but not into place groups. Learn more about group types here.
- Each organizational unit mapping imports a maximum of 500 users. Users beyond that aren't imported. If you need to import more than 500 users, please reach out to Kisi Support.
Set up the integration
- Sign in to Kisi
- Click the integrations icon (3x3 grid of dots) > Add Integration
- Enter a name, open the Type dropdown and select Google Directory User Import
- You'll be redirected to Google automatically
- Sign in with a Google Workspace administrator account and grant all requested permissions. The integration asks for your email address and read-only access to your directory's organizational units and users
- Once back in Kisi, click Add Organization Unit
- Under Select email account, choose the Google account
- Under Select Organization Unit, choose the unit to sync. The dialog previews some of the users in that unit
The organizational unit needs to be a sub-organization. To properly set up the integration, please make sure to create a new child organizational unit inside the existing unit in Google.
- Either choose a Kisi group under Select Group, or turn on Import Members Only
- For the group option, map users to the Kisi Group. A Kisi Group is needed to share access to your place(s) with your users.
- With Import Members Only, users will be imported but won't receive an invitation email from Kisi or have any access in your place(s)
- Leave Enabled on and click Save
Users are imported on the next sync, which runs about every 15 minutes. Synced users get an email that Kisi access was shared with them, unless you turned on Import Members Only.
How the sync works
On each sync, the integration reads the active members of every enabled organizational unit mapping and:
- matches existing Kisi users by email address and creates the users that don't exist yet
- updates a Kisi user's name when their full name changes in Google
- skips users who are suspended in Google
- adds users to the mapped Kisi group, and removes the memberships of users who are no longer in the organizational unit
The sync never deletes Kisi users. It only adds and removes group memberships.
Manage organizational unit mappings
One integration can map several organizational units to Kisi groups. Open the integration in Kisi to see all mappings in a table with the Email, Organization Unit, Group, Members only and Status columns.
- Add a mapping - click Add Organization Unit and configure it as described in Set up the integration
- Edit a mapping - click its row, change the settings and click Save. To pause a mapping, turn off Enabled
- Delete mappings - select the rows and delete them
You can't map the same organizational unit to the same Kisi group, or to Import Members Only, twice.
Turning on Import Members Only for an existing mapping clears its Kisi group. On the next sync, the integration removes the group memberships it created, so those users lose the access the group gave them.
When you delete a Kisi group, every organizational unit mapping that points to it is deleted as well.
A mapping's status is one of:
- Enabled - the mapping is synced
- Disabled - the mapping is paused, either by you or automatically (see Troubleshooting)
- Unauthorized - Google no longer accepts the account's authorization (see Reauthorize a Google account)
Manage Google accounts
You can authorize more than one Google account in the same integration, for example to sync organizational units from different Google Workspace admins.
- Open the integration in Kisi and click Settings
- In Configure Emails, you'll see each authorized Google account marked Valid or Invalid
- To add an account, click Add email and sign in to Google with that account
- To remove an account, click Delete next to it
An account that still has organizational unit mappings can't be deleted. Delete or reassign its mappings first.
Remove users imported from Google Workspace Directory
To remove a user's access, move them out of the synced organizational unit, or suspend or delete them in Google Workspace. Their membership in the mapped Kisi group is removed on the next sync. The Kisi user account itself isn't deleted.
This action will not remove the user from any other groups where they were added manually. Memberships in the mapped Kisi group are managed by the integration. Manual changes to that group's synced members are overwritten on the next sync, and a user who was already in the mapped group before the integration was set up loses that membership when they leave the organizational unit.
Troubleshooting
Google authorization failed
If Google sign-in doesn't complete, the app shows Google Authorization failed with one of these messages and a Retry button:
| Error | What to do |
|---|---|
| "Please select all requested permissions" | Click Retry and grant every permission on the Google consent screen. |
| "Only organization owners or administrators may perform this action." | Click Retry and sign in with a Google Workspace administrator account. |
Reauthorize a Google account
Google can revoke the integration's authorization, for example after a password change or when access is revoked. The account is then marked Invalid, its mappings show Unauthorized and stop syncing, and organization admins receive an email with the subject "Action Required: Kisi Integration Authentication Error".
To fix it, open the integration in Kisi, click an affected organizational unit and click Reauthorize. Alternatively, go to Settings > Add email and sign in with the same Google account.
The integration was disabled
If Kisi can't create new users because your subscription's user quota is exceeded, the whole integration is disabled. Organization admins receive an email with the subject "Action Required: Kisi Integration Disabled" and the reason "You have reached the maximum quota for the total number of users." Raise your user quota or reduce the number of users to import, then re-enable the integration.
A mapping was disabled
If Google rejects the user lookup for an organizational unit, for example because the unit was deleted or access to it is forbidden, Kisi sets that mapping to Disabled. Fix the organizational unit in Google or edit the mapping to select a different one, then turn Enabled back on.
Other messages
| Error | What to do |
|---|---|
| "This configuration already exists." | The organizational unit is already mapped to this group (or as members only). Edit the existing mapping instead. |
| "Unable to delete email – This email has Organization Units associated with it…" | Delete the account's organizational unit mappings first, then delete the account. |
Related articles
Remove the integration
- Sign in to Kisi
- Click the integrations icon (3x3 grid of dots) and select your Google Directory User Import integration
- Click Delete and confirm
Removing the integration deletes all of its organizational unit mappings. Imported users and their group memberships stay in Kisi, so remove them manually if they should no longer have access.