Google Workspace: Connect Restore Workspaces

Who can use this feature

Anyone with these permissions: Manage restore connections (Cloud workloads, SaaS applications)

This article explains how to connect a Google Workspace restore workspace so you can restore Google Workspace data into it.

Connect a restore workspace

In this procedure, you’ll connect a GCP project to run restore compute, then authorize Eon’s restore service account to write to your workspace. Restores run on a temporary restore server in the GCP project, and Eon writes the data back to your Google Workspace. For background, see Where restores run in Google Workspace Support.

You can connect a restore workspace from the SaaS applications page, by clicking New Connection and selecting Connect Google Workspace.

Before you start

Before you connect a Google Workspace restore workspace, make sure:

You can manage service accounts in the GCP project you’ll use for Google Workspace restore compute.
You have a dedicated account in the workspace for Eon to impersonate, with super admin privileges. Restoring group conversations requires super admin access. Use an account created for this purpose, not an administrator’s personal login. See Google’s domain-wide delegation best practices.
You can sign in to the Google Admin console as a super admin to authorize Eon’s restore service account.

Configure GCP restore project

Deploying the CLI script or Terraform module creates the restore service account and roles Eon needs, and enables the required Google APIs: Gmail, Google Drive, Admin SDK, Groups Settings, and Groups Migration.

Choose whether you want to deploy with the CLI or with Terraform:

gcloud CLI: Run the provided command with gcloud CLI to install the roles.
Terraform: Use the provided Terraform module to install the roles.

Bash

Terraform

Select the gcloud CLI deployment method.
Paste your GCP Project ID. The command you’ll need to run is displayed, including your GCP project ID and Eon-provided project IDs.
Paste the provided command in a terminal and run. The command downloads and runs a script that installs the necessary roles using gcloud CLI. You can review the script before running it.

Wait for the script to complete before continuing.

Click Next. Eon verifies that the necessary roles and APIs are installed in the project before continuing.

Authorize Eon's restore service account

Eon displays the restore service account’s Client ID and Scopes.

Sign in to Manage Domain Wide Delegation as a super admin.
Click Add new, paste the Client ID and OAuth Scopes copied from Eon, then click Authorize.

Identify your workspace

In Primary domain, enter the primary domain of the workspace, such as company.com. You can find this in the Google Admin console, under Manage domains.
In Delegated admin email, enter the dedicated account Eon impersonates when it writes to your workspace.
In Workspace display name in Eon, enter the name you want to identify this restore workspace by in Eon.

Confirm

Click Connect. Eon verifies the delegation, then connects the GCP project and the Google Workspace restore workspace.

You can now restore Gmail messages, Drive files and folders, shared drives, and groups into this workspace.

Expanding the connected restore account shows its Project name, Project ID, Restore service account, Delegated admin, and Restore server connectivity. To change how the restore server reaches Eon and your project, see GCP: Customize Restore Server Configuration.