Create Google Workspace Credentials

For the Shefware Google Workspace to Office 365 Migration Tool. Follow the steps below as a Super Admin to create a Service Account and a JSON key.

Part 1: Create a Google Cloud project

1. Open the Google Cloud Console and sign in as Super Admin.
2. Open Create a new project, or go to IAM & Admin > Manage resources > CREATE PROJECT.
3. Enter a unique Project name, leave the other fields as default, and click CREATE.
4. Click the project name in the title bar and make sure your new project is selected.

Part 2: Enable the required APIs (and optional consent screen)

1. Open the API Library and enable each API. Click a link, then click ENABLE:
   • Gmail API
   • Admin SDK API
   • Google Drive API
   • Google Calendar API
   • Google People API
   • Google Chat API
   • Contacts API: search for it in the API Library and enable it if listed for your project.
2. Open the OAuth consent screen, choose External, then CREATE if prompted.
3. Under Branding, enter the App name and User support email. Under Authorized domains, click ADD DOMAIN and enter your domain. Add the developer contact email and click SAVE. Note the App name.
4. Under Data access, click Add or remove scopes, paste the scope list from Part 5 into Manually add scopes, click Add to table, then Update and SAVE.

Part 3: Configure the Google Chat app (Google Chat migration only)

1. Open APIs & Services > Google Chat API > Manage > Configuration (start from the Google Chat API page).
2. Under Application info: enter the App name (same as on the consent screen), Avatar URL https://localhost, and a short Description.
3. Under Connection settings, choose HTTP endpoint URL and enter https://localhost.
4. Under Visibility, enter the email addresses of individuals and groups in your domain, separated by commas.
5. Tick Log errors to Logging and click SAVE.

Part 4: Create the Service Account

1. Open Credentials and click CREATE CREDENTIALS > Service account.
2. Enter a Service account name. The Service Account ID fills in automatically. Click CREATE AND CONTINUE.
3. The role and user access steps are optional. Click DONE.
4. Open the Service Accounts list and click your new service account.
5. Copy and save the Email (Service Account Email) and the Unique ID (Client ID).

Part 5: Assign domain-wide delegation

1. Open the Google Admin Console and go to Security > Access and data control > API controls, or go straight to the Domain-wide delegation page.
2. Under Domain-wide delegation, click MANAGE DOMAIN-WIDE DELEGATION.
3. Click Add new.
4. In Client ID, paste the Unique ID of the service account.
5. In OAuth scopes, paste the full scope list given below (use the Copy all scopes button).
6. Click AUTHORISE.

OAuth scopes (copy and paste all at once)

One comma-separated line with no spaces or line breaks. Click Copy all scopes, then paste it into the OAuth scopes field in one go.

https://mail.google.com/,https://www.googleapis.com/auth/contacts.readonly,https://www.googleapis.com/auth/calendar.events.readonly,https://www.googleapis.com/auth/calendar.events,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.user,https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/contacts,https://www.googleapis.com/auth/admin.directory.userschema.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly,https://www.googleapis.com/auth/calendar.readonly,https://www.googleapis.com/auth/calendar.settings.readonly,https://www.googleapis.com/auth/gmail.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/drive.metadata.readonly,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/drive.file,https://www.googleapis.com/auth/userinfo.profile,https://www.googleapis.com/auth/gmail.labels,https://www.googleapis.com/auth/gmail.settings.basic,https://www.googleapis.com/auth/tasks,https://www.googleapis.com/auth/ediscovery.readonly,https://www.googleapis.com/auth/chat.spaces,https://www.googleapis.com/auth/chat.messages,https://www.googleapis.com/auth/chat.messages.reactions,https://www.googleapis.com/auth/chat.memberships,https://www.googleapis.com/auth/gmail.metadata,https://www.googleapis.com/auth/gmail.modify,https://www.googleapis.com/auth/gmail.insert,https://www.googleapis.com/auth/tasks.readonly,https://www.googleapis.com/auth/drive.appdata,https://www.googleapis.com/auth/admin.directory.domain,https://www.googleapis.com/auth/admin.directory.group,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/documents,https://www.googleapis.com/auth/drive.metadata,https://www.googleapis.com/auth/apps.groups.migration

Part 6: Create the JSON key

1. Open the Service Accounts list and click your service account.
2. Open the Keys tab.
3. Click ADD KEY > Create new key.
4. Select JSON (not P12) and click CREATE.
5. The .json file is saved to your computer. Move it to a safe folder.

Part 7: Add the credentials to the migration tool

1. Open the Shefware migration tool and go to the Google Workspace source connection.
2. Enter the Super Admin Email Address (Account Login Email ID).
3. Enter the Service Account Email Address from Part 4.
4. Click Browse and select the downloaded .json key file.
5. Click Add or Next to validate.

Troubleshooting