Google Workspace (Gemini)
Gemini inside Gmail, Docs, Sheets and other Workspace apps has no website of its own, so the browser extension cannot see it. The Google Workspace (Gemini) connector reads Google's Gemini audit log on the server instead and records each Gemini action in Discover AI as the tool Gemini in Workspace. No client is needed on the device.
The standalone Gemini web app (gemini.google.com) is a separate tool, detected
by the browser extension.
What is recorded
For each Gemini action, the connector records:
- Who used Gemini, by the email address in the audit log.
- The Workspace app, the kind of action and where it was started, for example
docs: help_me_write. - When it happened.
It records no prompts, responses or file contents: Google's audit log does not carry them. The connector has read-only access to the audit log and never reads email, files or prompts.
- Each action counts as an interaction. Typed requests, such as a chat message or a help me write prompt, are recorded as prompts. Button actions such as summarize or proofread are recorded as feature use.
- Actions that Gemini starts on its own, such as proactive suggestions, are not counted.
- When Directory Integration is connected and the email matches a directory user, the record also carries the person's identity provider user ID.
Requirements
- The
enterprise-governanceentitlement (Enterprise plan). Without it, the card does not appear in Organization Settings > Integrations. - Write access to Discover AI configuration at the organization level, which Owner and Department Admin have by default, or a custom role that grants it. See Members & Roles. Saving the connection asks for step-up verification when it is enabled.
- At least one project in the organization, to receive the data.
- A Google Workspace with Gemini licences, and a Workspace super admin to set up domain-wide delegation.
Set up Google Workspace
Create a service account
In a Google Cloud project, create a service account and download a JSON key for it.
Turn on domain-wide delegation
In the Google Admin console, open Security > Access and data control > API controls > Domain-wide delegation. Add the service account's client ID with this scope:
Choose the admin to impersonate
The connector reads the audit log as a Workspace admin. Use an admin account whose role has the Audit & Investigation privilege.
See Google's guide to authorizing requests to the Reports API.
Connect ANTS Platform
Open the connector
Go to Organization Settings > Integrations and open Google Workspace (Gemini).
Enter the details
| Field | Value |
|---|---|
| Send data to project | The ANTS Platform project that receives the Gemini usage |
| Admin email to impersonate | The Workspace admin from the previous step |
| Service account key (JSON) | The whole JSON key file |
| Customer ID (optional) | Your Workspace customer ID. Leave it empty to use my_customer, the admin's own Workspace. |
Test and save
Select Test connection. On success it shows "Connected. Google returned the Gemini audit log." Then select Save & connect.
The key is encrypted and never shown again. To change the details, select Edit credentials and paste the key again.
Sync
- The connector syncs every 15 minutes. Select Sync now to start a sync in the background; repeated clicks within a minute start one sync.
- The first sync reads the last 24 hours. Later syncs continue from where the last one stopped and re-read the 2 hours before it, because Google's audit log can lag. Records are never counted twice.
- A sync never reads further back than 30 days.
- Changing the project, admin email, customer ID or service account, or disconnecting and connecting again, starts again from the last 24 hours. Activity older than that is not backfilled.
Once connected, the connector shows the project, admin email, service account, customer ID, Last sync and Recent syncs, the last five runs with the number of events added and skipped. A run that skipped events, for example events with no user email, is shown as partial. A failed run shows Sync failed with Google's error.
Disconnect removes the stored key and stops the sync at once. Sync history is kept.
Where the data appears
Gemini use lands in the project you chose and appears in the Discover AI views for that project, such as AI Usage Intelligence, AI Tools and Users, as Gemini in Workspace. The Workspace app and action are shown in each event's details. You can set a sanction status and risk level for it like any other tool. See AI Tools, Registry & Policy.
Troubleshooting
- No Google Workspace (Gemini) card. The organization does not have the
enterprise-governanceentitlement, or your role lacks Discover AI configuration access. - "Create a project in this organization first." The organization has no project to receive the data.
- Test connection fails with "Google rejected the credentials". Check that the key is the right one, that the service account's client ID is listed under domain-wide delegation with the scope above, and that the admin email is a Workspace admin.
- Test connection fails when reading the log. Check that the admin has the Audit & Investigation privilege and that the customer ID is right.
- Connected, but no Gemini usage. Check that people in the Workspace have Gemini licences and have used Gemini since the first sync window. Look at Recent syncs for skipped events or errors.