AI security & operations for MSPs

Google Workspace

The same depth Hal reads from Microsoft 365, for the Google side of a mixed book, including the OAuth grants that a Microsoft-shaped checklist never asks about.

The Google-shaped risk, not the Microsoft one translated

A book of business that runs both does not get one threat model. The Workspace side has its own front door: a user granting a third-party app access to their Drive or mail through OAuth, which needs no password and survives a password reset.

Google’s security and admin feeds carry those grants. Hal reads them alongside the login events, so a token issued to an app nobody has heard of is visible the same way a suspicious sign-in is, rather than sitting in a console no one opens between audits.

What Hal reads
Admin reports, login events and security events.
How it connects
A service account with domain-wide delegation, granted in your own Google admin console. Its scopes are read-only apart from Alert Center’s one scope, which can also change alerts; Hal only reads with it. Read-only by architecture →
Cadence
Every few minutes.
Revocation
Remove the delegation in the admin console at any time.
Setup
Scopes, steps and troubleshooting: in the docs →
The Hal portal log sources table: every client's sources listed with the source type, its tenant (the Microsoft 365 organization or the Google Workspace domain), whether it is active or aging, when it last reported, how much it has stored, and the silence threshold past which a quiet source becomes a flag
A mixed book reads as one table. Google Workspace sits beside Microsoft 365 and Entra ID for the same clients, on the same cadence, each with its own silence threshold, Google’s a little longer because Google delivers its reports late. Nothing about the Google side is a second-class citizen.

See what Hal surfaces on your own clients.

No deck. Ask us anything first. When you want to see Hal on your own tenants, we sign a short evaluation agreement and stand up your instance; you connect one tenant, Hal watches it for 14 days, and we walk you through what he found.

Book a walkthrough Pricing
  1. 01You ask us your questions. No deck, no demo dataset.
  2. 02You sign a short evaluation agreement, and we stand up your own instance.
  3. 03You connect one tenant from your own admin console. Hal watches it for 14 days.
  4. 04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.