Shefware Logo
INFOSetup Guide

Create Google Workspace Credentials

Follow this step-by-step administrator guide for the Shefware Google Workspace to Office 365 Migration Tool. As a Super Admin, complete the steps below to configure a Google Cloud Service Account, delegate domain-wide permissions, and download the required JSON authentication key.

Role: Super Admin
Est. Time: 10–15 Mins
Key Type: JSON Key File
1

Part 1: Create a Google Cloud Project

  1. Open the Google Cloud Console and sign in with your Super Admin account.
  2. Open Create a new project , or navigate to IAM & Admin > Manage resources > CREATE PROJECT.
  3. Enter a unique Project name (e.g., Shefware-GW-Migration), leave the other fields as default, and click CREATE.
  4. Click the project name dropdown in the top title bar and ensure your newly created project is selected.
2

Part 2: Enable Required APIs & Consent Screen

  1. Open the API Library and enable each required API below. Click each link, then click the blue ENABLE button:
    Gmail APIAdmin SDK APIGoogle Drive APIGoogle Calendar APIGoogle People APIGoogle Chat API

    *Contacts API: If listed for your project region, search for it in the API Library and enable it as well.

  2. Open the OAuth consent screen , choose External, then click CREATE if prompted.
  3. Under Branding, enter the App name and User support email. Under Authorized domains, click ADD DOMAIN and enter your domain name. Add your developer contact email and click SAVE. (Keep note of the App name).
  4. Under Data access, click Add or remove scopes, paste the scope list from Part 5 into Manually add scopes, click Add to table, then Update and SAVE.
3

Part 3: Configure Google Chat App (Google Chat Migration Only)

  1. Navigate to APIs & Services > Google Chat API > Manage > Configuration (or begin from the Google Chat API page ).
  2. Under Application info: enter the App name (matching the consent screen), set Avatar URL to https://localhost, and provide a short description.
  3. Under Connection settings: select HTTP endpoint URL and enter https://localhost.
  4. Under Visibility: enter the email addresses of individuals and groups in your domain, separated by commas.
  5. Tick Log errors to Logging and click SAVE.
Note: Group access changes in Google Workspace directory can take up to 24 hours to fully propagate.
4

Part 4: Create the Service Account

  1. Open Credentials and click CREATE CREDENTIALS > Service account.
  2. Enter a Service account name (e.g. shefware-migration-svc). The Service Account ID will populate automatically. Click CREATE AND CONTINUE.
  3. The optional role assignment and user access steps can be skipped. Click DONE.
  4. Open the Service Accounts list and click on your new service account.
  5. Copy and safely store both the Email (Service Account Email) and the Unique ID (Client ID / OAuth2 Client ID).
5

Part 5: Assign Domain-Wide Delegation

  1. Open the Google Admin Console and go to Security > Access and data control > API controls, or go directly to the Domain-wide delegation page .
  2. Under Domain-wide delegation, click MANAGE DOMAIN-WIDE DELEGATION.
  3. Click Add new.
  4. In the Client ID field, paste the Unique ID (numeric Client ID) of the service account copied in Part 4.
  5. In the OAuth scopes field, paste the complete comma-separated scope string below using the Copy all scopes button.
  6. Click AUTHORISE.

OAuth Scopes (Copy all at once)

Single comma-separated string without spaces or line breaks.

https://mail.google.com/,https://www.googleapis.com/auth/contacts.readonly,https://www.googleapis.com/auth/calendar.events.readonly,https://www.googleapis.com/auth/calendar.events,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/contacts,https://www.googleapis.com/auth/admin.directory.userschema.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/calendar.readonly,https://www.googleapis.com/auth/calendar.settings.readonly,https://www.googleapis.com/auth/gmail.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/drive.metadata.readonly,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/drive.file,https://www.googleapis.com/auth/userinfo.profile,https://www.googleapis.com/auth/gmail.labels,https://www.googleapis.com/auth/gmail.settings.basic,https://www.googleapis.com/auth/tasks,https://www.googleapis.com/auth/ediscovery.readonly,https://www.googleapis.com/auth/chat.spaces,https://www.googleapis.com/auth/chat.messages,https://www.googleapis.com/auth/chat.messages.reactions,https://www.googleapis.com/auth/chat.memberships,https://www.googleapis.com/auth/gmail.metadata,https://www.googleapis.com/auth/gmail.modify,https://www.googleapis.com/auth/gmail.insert,https://www.googleapis.com/auth/tasks.readonly,https://www.googleapis.com/auth/drive.appdata,https://www.googleapis.com/auth/admin.directory.domain,https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/documents,https://www.googleapis.com/auth/drive.metadata,https://www.googleapis.com/auth/apps.groups.migration
Module Scopes Tip: For Google Chat to Microsoft Teams migrations only, the minimum scope set is chat.spaces, chat.messages, chat.memberships, chat.messages.reactions, admin.directory.user, drive, drive.file, and documents (prefixed with https://www.googleapis.com/auth/). The full list above safely unlocks all migration modules.
Delegation changes may require 3 to 10 minutes to take full effect globally.
6

Part 6: Create & Download the JSON Key

  1. Return to the Service Accounts list and click on your service account.
  2. Open the Keys tab along the top.
  3. Click ADD KEY > Create new key.
  4. Select JSON (do not choose P12) and click CREATE.
  5. The private .json key file will download to your machine. Move it to a secure, accessible folder on the machine where you run the migration tool.
Security Warning: Google generates this key file only once. It holds administrative access to delegated Workspace data. Never share it over insecure email or chat. If it is misplaced or compromised, immediately delete it in the Keys tab and issue a new one.
7

Part 7: Add Credentials to Shefware Migration Tool

  1. Launch the Shefware Google Workspace Migration Tool and navigate to the Google Workspace source connection screen.
  2. Enter your Super Admin Email Address (Account Login Email ID).
  3. Enter the Service Account Email Address copied in Part 4.
  4. Click Browse and choose the downloaded .json key file from Part 6.
  5. Click Add or Next to authenticate and load your Google Workspace users and data!

Troubleshooting & Frequently Encountered Issues

ProblemLikely Cause & Resolution
Key creation is blocked or CREATE is disabledAn organisation policy ("Disable service account key creation") is on. A Google Cloud Organisation Policy Administrator must allow key creation for this project.
unauthorized_client or access_deniedDelegation is missing, the Client ID is wrong, or a scope is missing. Repeat Part 5 and paste the full scope list again.
Scope field rejects the listMake sure it is one line, comma-separated, with no spaces, line breaks, or trailing comma.
403 or API not enabledEnable every API from Part 2 in the same project where the service account was created.
Tool cannot read the keySelect the .json file (not P12) and do not edit its contents.
Chat access not workingCheck Visibility in Part 3. Group changes can take up to 24 hours.