Identity and access management
Remote to Google Workspace integration: Google accounts for employees hired through Remote
With an integration between Remote and Google Workspace, everyone hired through Remote gets a Google account in the organisational unit of their country, with job title, department and manager. The new Google address goes back to Remote, and the account is only suspended on the end date Remote has confirmed after the offboarding.
What the integration does
Organisations that employ staff in other countries through Remote and work on Google Workspace themselves often create the Google accounts by hand. The address then also has to go into Remote, and on a departure in another country IT does not always know which date stood after the country review.
- In Remote an administrator creates an API token with only the scopes for reading employments and writing the work address.
- In Google KoppelHet gets a service account with domain-wide delegation, limited to users, groups and file transfer.
- As soon as Remote reports a new employment, KoppelHet creates the Google account in the country's organisational unit, suspended until the onboarding is complete.
- The Google address goes back to the employment in Remote.
- After a confirmed offboarding KoppelHet suspends the account on the end date, transfers files and deletes it after the retention period.
What to watch for with Remote and Google Workspace
- Remote itself connects to Google Workspace for single sign-on, through a custom SAML app in Google. That sign-in does not create or suspend accounts. KoppelHet handles the accounts, and single sign-on to Remote keeps working with the same Google account.
- Remote offers employees as SCIM users with department, employee number and manager, but read-only and with a filter in the form field eq value. KoppelHet uses that list for the daily comparison with Google and Remote's notifications for changes.
- The work address can only be written through Remote's API for an employment that is invited or active, not for contractors. KoppelHet writes the Google address back for employees and reports contractors to HR, who fill in the address in Remote themselves.
- An employment at Remote first goes through invitation and onboarding, and can still drop out in that phase. KoppelHet already creates the Google account so the address is known, but keeps it suspended until onboarding is complete, and deletes it again if the employment does not go ahead.
- On an offboarding Remote first checks the country's rules, and the end date can still move after that. KoppelHet only suspends the Google account on the date Remote has confirmed, so a colleague in Germany or Brazil does not lose their mail too early.
- A confidential offboarding is not in Remote's regular list and must be requested separately. KoppelHet requests it, uses only the end date and puts no reason in Google, not even as a suspension reason.
- Employees through Remote are in many countries, and in Google the organisational unit determines which policy applies. KoppelHet picks the unit from country and type of employment, so sharing outside the domain, for example, can differ per country or for contractors.
This integration is also part of joiner, mover, leaver.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Do contractors through Remote also get a Google account?
If you want, in their own organisational unit. HR then has to fill in their work address in Remote themselves.
What happens to a leaver's files?
KoppelHet transfers them to the manager before the account is deleted after the retention period.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Remote through the Remote API (gateway.remote.com) with a Customer API token with limited scopes. GET /v1/employments, SCIM GET /v1/scim/v2/Users (read-only, filter only attribute eq value), webhooks signed with X-Remote-Signature; confidential offboardings with include_confidential. Write-back with PATCH /v1/employments/{employment_id} (work_email for invited and active), scope employment:write.
- Google through the Admin SDK Directory API (users with externalIds, name, primaryEmail, password on creation, orgUnitPath, organizations, relations type manager and suspended; groups and members) and the Data Transfer API for Drive, with a service account with domain-wide delegation.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Remote | Field in Google Workspace | Notes |
|---|---|---|
employment id | externalIds (type organization) | |
SCIM name.givenName, name.familyName | name.givenName, name.familyName | |
Naamgevingsregel | primaryEmail | |
job_title | organizations.title | |
department (SCIM enterprise-extensie) | organizations.department en groepen | |
manager (SCIM enterprise-extensie) | relations (type manager) | |
country en employment_type | orgUnitPath | |
Bevestigde einddatum offboarding | suspended = true | |
primaryEmail (Google) | work_email |
Related
Greenhouse → Remote
Greenhouse to Remote integration: foreign hires as EOR employment with the country's form
Recruitee → Remote
Recruitee to Remote integration: hires abroad straight into an employment at Remote
Remote → 4PS Construct
Remote to 4PS Construct integration: own employees of the construction entity from Remote in 4PS
Remote → Active Directory
Remote to Active Directory integration: accounts for colleagues in other countries