Skip to main content

Google Workspace Admin MCP server

Automate enterprise administration tasks across your Google Workspace domain with an AI agent. This MCP server lets you programmatically manage users, groups, organizational units, devices, and security settings—enabling AI to handle onboarding, policy enforcement, and compliance monitoring at scale.

Setting up an MCP server

This article covers the standard steps for creating an MCP server in AI Gateway and connecting it to an AI client. The steps are the same for every integration — application-specific details (API credentials, OAuth endpoints, and scopes) are covered in the Authentication section on this page.

Before you begin

You'll need:

  • Access to AI Gateway with permission to create MCP servers.
  • API credentials for the application you're connecting (see the Authentication section on this page for what to collect).

Create an MCP server

Find the app in the catalog

  1. Sign in to AI Gateway and select App Catalog from the left navigation.
  2. Search for the application you want to connect, then select it from the catalog.
  3. Select Create MCP Server to start the wizard.

App Configuration

Confirm the Base URL for the API, then, under Tools, select the endpoints you want to expose. Select Next.

MCP Server Setup

  1. Enter a Name for your server — something descriptive that identifies both the application and its purpose.
  2. Enter a Description so your team knows what the server is for.
  3. Set the log level: choose Production Mode for terser logs, or Non-Production Mode for more verbose logs that can help with debugging.
  4. Select Next.

Authentication

Enter the authentication details for the application. This varies by service — see the Authentication section on this page for the specific credentials, OAuth URLs, and scopes to use.

Review

Look over the summary of your MCP server configuration, then select Create & Deploy. AI Gateway provisions the server and provides a server URL you'll use when configuring your AI client.


Connect to an AI client

Once your server is deployed, you'll need to add it to the AI client your team uses. Select your client for setup instructions:

Tips

  • You can create multiple MCP servers for the same application — for example, a read-only server for reporting agents and a read-write server for automation workflows.
  • If you're unsure which OAuth scopes to request, start with the minimum read-only set and add write scopes only when needed. Most application pages include scope recommendations.

Authentication

The Google Workspace Admin API uses OAuth 2.0 with domain-wide delegation. Set up your credentials in Google Cloud Console, then configure the MCP server with your Client ID and Client Secret. In Google Cloud Console, go to IAM & Admin > Service Accounts to create a service account and enable domain-wide delegation, then authorize it in the Google Admin console under Security > API Controls > Domain-wide delegation.

ValueSetting
Auth endpointhttps://accounts.google.com/o/oauth2/v2/auth
Token endpointhttps://oauth2.googleapis.com/token
Scopeshttps://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/admin.directory.group, https://www.googleapis.com/auth/admin.directory.device.mobile, https://www.googleapis.com/auth/admin.directory.device.chromeos, https://www.googleapis.com/auth/admin.reports.audit.readonly

Available tools

These tools allow you to manage users, groups, organizational units, devices, and security configurations across your domain.

ToolDescription
Create userCreate a new user account with name, email, and profile information
Update userModify user properties including profile, organizational unit, and account status
Suspend/delete userSuspend or permanently delete a user account
List usersRetrieve all domain users with filtering options
Manage user passwordsSet or reset user passwords and password policies
Create groupCreate a new distribution or security group
Manage group membershipAdd or remove members from groups
List groupsRetrieve all groups or groups for a specific user
Create organizational unitCreate a new OU in the domain hierarchy
Move users to OURelocate users between organizational units
Manage devicesWipe, lock, or approve mobile and Chrome devices
Configure security policiesSet 2FA requirements, password policies, and API access rules
View audit logsRetrieve admin activities and security events
Generate usage reportsObtain statistics on storage, active users, and adoption rates

Tips

Use minimal required scopes to reduce security risk—request only the permissions you need for your automation tasks.

Implement domain-wide delegation with a service account rather than user credentials to ensure consistency and avoid single-user dependency.

Rotate service account keys periodically and monitor domain-wide delegation scopes in the admin console to catch unauthorized access attempts.

Use batch requests when managing bulk operations like user imports or device policies to stay within rate limits (2,400 queries per minute).

Test your automation in a non-production organizational unit before rolling out organization-wide to prevent unintended changes to active users.