Google Workspace Integrations

In practice, most business software, by one of four routes: an app installed from the Google Workspace Marketplace, Google acting as the sign-in provider for another product, something built directly against the Gmail, Drive, Sheets, Calendar or Admin APIs, or a piece of glue in the middle such as Apps Script or a third-party automation platform. The interesting question is rarely whether a connection is possible. It is what that connection is allowed to reach, and who is responsible for it when it stops working.

Yes, and it is one screen in the admin console — Security, then Access and data control, then API controls. Google's documentation defines three access levels for an application: Trusted, which overrides a service restriction; Limited, which can reach only unrestricted Google services; and Blocked, which can reach nothing. For applications you have not configured, you can block third-party API access altogether, allow sign-in access only, or allow general access, with the available options depending on your edition. Google has also made it possible to configure an application against selected API scopes rather than all-or-nothing. Checked against Google's own administrator documentation in September 2026.

Through the same API controls section, which lists the applications that have been granted access to your organisation's data. This is worth doing before any new integration work, and it is the single most useful hour we spend with a new client. What turns up is rarely malicious — it is a tool somebody trialled in 2022 to solve a real problem, granted access to their mail, and then stopped using. The access did not stop when the enthusiasm did, and nobody ever had a reason to look.

It is, and it is usually the best-behaved one. If a product only uses Google to establish who you are, it is not being handed your mail or your files — it is being told your identity. That makes it both the lowest-risk connection and a genuine security improvement, because it removes another password and it means suspending the Google account closes that door too. Worth checking what the application actually requests, though: some ask for identity and then rather more besides, and the consent screen is where that becomes visible.

It depends on who will look after it. A platform costs a subscription but is visible, configurable by a non-developer and does not depend on one person's knowledge. Apps Script costs nothing in licence terms but is software, and it needs an owner, a place to live that is not somebody's personal Drive, and a failure alert. For a connection that a business genuinely depends on, the subscription is often the cheaper of the two once you count the second year.

Partly, because Zoho documents its Google connections properly rather than leaving you to build them — single sign-on with Google as the identity provider, Gmail inside Zoho CRM, and calendar, contact, task and Drive sync. That is a supported arrangement rather than a workaround, and we have set it out separately on the Zoho and Google Workspace page, including the one decision to make before you run both.

Against a written specification, never against a conversation, because the cost of an integration is dominated by cases nobody mentioned in the first meeting — what happens to duplicates, what happens when the other system is down, what happens to a record that was edited on both sides. We quote the access review as a separate short piece of work, and it is worth doing on its own even if you build nothing.