Azure / Azure/Azure-Sentinel

Google Workspace Activities (CCF) connector supports only one Google Workspace tenant per Sentinel workspace

Open
#14,657 1 comment 0 reactions 3 assignees Claimed by @hassanchawiche View on GitHub
Codeless Connector Framework (CCF) Connector Connector
Dominant language
Python
Stars
6.1k
Forks
3.8k
Avg merge
4d 7h
Merged PRs (30d)
125

Description

**Describe the bug**
The Google Workspace Activities connector (Codeless Connector Framework, Preview — solution azuresentinel.azure-sentinel-solution-googleworkspacereports, connector definition id GoogleWorkspaceCCPDefinition) exposes only a single OAuth2 authorization-code form (one Client ID / Client Secret / Connect). After a connection is established, the credential fields lock and the connector page offers only Disconnect — there is no "Add new collector / connection" grid like the GCP Pub/Sub CCF connectors provide. Consequently a single Sentinel workspace can ingest Google Workspace audit activity from only one Google Workspace tenant through this connector, with no supported way to add a second tenant. This is a problem for organizations running multiple Google Workspace tenants that consolidate telemetry into one Sentinel workspace.

**To Reproduce**
Steps to reproduce the behavior:
1. In the Azure portal, install the Google Workspace solution from Content Hub, then go to Microsoft Sentinel → your workspace → Configuration → Data connectors → Google Workspace Activities (via Codeless Connector Framework) → Open connector page.
2. Enter the Client ID and Client Secret for the first Google Workspace tenant, click Connect, and complete the Google OAuth consent as that tenant's super admin. Connector status changes to Connected.
3. Attempt to connect a second Google Workspace tenant: observe there is no "Add new connection/collector" control, and the Client ID / Client Secret fields are now greyed out — the only available action is Disconnect (which replaces, not adds to, the existing connection).

**Expected behavior**
The connector should allow multiple connections/tenants within a single Sentinel workspace — consistent with the multi-connection capability the CCF already supports (e.g. the "Add new collector" experience on the GCP Pub/Sub connectors) — so each Google Workspace tenant can be authorized independently and write to the same GoogleWorkspaceReports table. Records should carry a field distinguishing the source tenant (the Reports API id.customerId is present in the payload) so multi-tenant data can be filtered/split in KQL.

**Screenshots**

Image

**Desktop (please complete the following information):**
- OS: MacOS
- Browser: Chrome, Safari, Edge

**Additional context**
1. Connector/solution version 3.0.5; observed 2026; Sentinel in the Azure portal.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.