Google endpoint management
Proofroom reads the devices Google manages or sees through the Cloud Identity Devices API, as a service account acting for an administrator through domain-wide delegation. Add it on Integrations → Catalogue → Google endpoint management → Connect.
What each collector shows
| Collector | Kind | Default cadence | What it shows | Suggested controls |
|---|---|---|---|---|
| Device inventory with encryption | snapshot | monthly | Every managed device with its user, platform, OS version, last check-in and disk encryption (Google’s encryption state; a device that cannot encrypt counts as not encrypted. Compromised devices are flagged). Devices not encrypted come first. | PCI DSS 12.5.1; SOC 2 CC6.1, CC6.7 |
| Operating system versions | snapshot | monthly | Each device’s OS version against your minimum for its platform, or, with no minimum, the newest version seen on that platform. Without a minimum the evidence shows drift, not patching: the headline says so and PCI DSS 6.3.3 is suggested only once you set minimums. | PCI DSS 6.3.3 (with minimums); SOC 2 CC7.1 |
| Screen lock | snapshot | quarterly | Whether every user on each device has a password set (Google’s password state, the only screen-lock signal it reports). Devices with no user reported show unknown. This shows a password is set, not how soon the device locks when idle, so it is not suggested for PCI DSS 8.2.8. | SOC 2 CC6.1 |
| Devices not checking in | snapshot | monthly | Devices not seen for 30 days (or the number you set). Their encryption, updates and screen lock can no longer be confirmed. | PCI DSS 12.5.1; SOC 2 CC7.1 |
The connection also takes staleDays (30 by default) and, optionally, minimumOsVersions: one line per
platform, such as macOS 15.6, Windows 10.0.26100 or iOS 18.6. A configured minimum wins over one read from the
system. Without a minimum, a platform is compared with the newest version seen on any of its devices, which shows drift
but not whether a version is still supported.
Disk encryption is mapped to SOC 2 CC6.1 and CC6.7, not to PCI DSS 3.5.1: PCI DSS accepts disk-level encryption for stored card numbers only on removable media (3.5.1.2), so laptop encryption is not evidence for 3.5.1.
The device inventory also feeds the Endpoint coverage built-in (computers without endpoint protection, leavers’ devices), the Endpoints posture score, and a risk suggestion when devices in use are not encrypted (Admin → Risks → Raised automatically).
Phones and tablets appear when Google endpoint management covers them; computers appear when they run Endpoint Verification or Google’s Windows device management. Wiped devices are left out.
Set up the service account
- In Google Cloud, pick or create a project, enable the Cloud Identity API, create a service account and a JSON key for it. If key creation is blocked, see the note under the key field (an organization policy blocks it by default for organizations created since 3 May 2024).
- In the Google Admin console, go to Security → Access and data control → API controls → Manage domain-wide
delegation → Add new. Enter the service account’s client ID and the scope
https://www.googleapis.com/auth/cloud-identity.devices.readonly. - Choose an administrator for Proofroom to act as: one who can see devices in the Admin console (for example a custom role with the Services → Mobile device management → Manage devices and settings privilege read only, or a super administrator).
Google does not accept a service account on its own for this API: domain-wide delegation is required. Proofroom reads when the key was made (and its expiry, if an organisation policy sets one) from Google’s public certificates, and asks you to replace a key that never expires a year after it was made.
Connect
| Field | Value |
|---|---|
| Service account key | The JSON key file, pasted whole |
| Administrator email | From step 3 |
| Customer | my_customer |
staleDays, minimumOsVersions |
See above |
Test connection signs in as the administrator and reads one device.
Known limits
-
UNVERIFIED: which devices each list view returns. Proofroom reads both the user-assigned and the company-inventory views and keeps each device once.
-
UNVERIFIED: which Workspace or Cloud Identity editions return device data through this API, and the least administrator privilege the delegated user needs.
-
Google returns at most 20 device users a page, so large fleets take many requests.