Set Up Service Account For xFanatical Foresight

This article is written for Google Workspace Super Admins, as part of xFanatical Foresight documentation.

Introduction to Service Account

A service account is a special Google account that belongs to an application, not to a person. It has no password and cannot sign in the way you do. Instead, an application uses it to call Google Workspace APIs securely.
In xFanatical Foresight, the service account lets your automations run on behalf of users in your Google Workspace domain(s). Each user doesn't have to sign in xFanatical Foresight and set up the automations.

Here is how a Service account compares to your Google Admin account:

Because automations don't depend on one person's sign-in, they keep running if someone changes their password, loses admin access, or leaves the organization. To learn more, see Google's overview of service accounts.

Why Service Account?

Without a service account, xFanatical Foresight can only act as you, using the Google account you connected. That works for your own calendar, mailbox and files. It does not work when an IT workflow needs to act for someone else in your organization. 

A service account solves this. With it, an administrator can build rules that:

• Act as another user in your Google Workspace domain, such as updating a colleague's calendar or setting a vacation responder for them.
• Keep running when the rule's owner changes their password, loses admin access, or leaves the organization.
• Use only the permissions you authorize, which you can review, change or remove at any time. Learn more about domain-wide delegation.

Setting up a service account does not change your existing rules. Rules that already run keep running. The service account only adds new capabilities.

Service Account for xFanatical Foresight

xFanatical Foresight sets up and manages the service account for you. Most of the setup is automatic. A Google Workspace Super Admin only needs to do one manual step in the Google Admin Console.

The Service Accounts section in Settings > Security, before a service account is set up


A service account with ready to use state

How it works:

1. xFanatical Foresight creates a dedicated Google Cloud project and service account in Google Cloud Platform (GCP) by your Google account (automatic).
2. A Super Admin authorizes Domain Wide Delegation for the service account in the Google Admin console (manual, one-time).
3. xFanatical Foresight checks that the delegation and the required permissions are applied correctly.
4. Your automation rules can now run on behalf of users in your organization.

The service account appears in Google Cloud with the name xFanatical Foresight, and in Google Admin Console with the service account email such as xfanatical-foresight-1234@xfanatical-longtext.iam.gserviceaccount.com .

Frequently Asked Questions

• What is a service account?
  A non-human Google account that xFanatical Foresight uses to run approved Google Workspace automations on behalf of users in your organization. Users don't need to sign in and authorize each action.
• How is a service account different from my Google Admin account?
  Your Google account belongs to a person, has a password and signs in interactively. A service account has no password, cannot sign in, and is controlled only through the permissions (OAuth scopes) you authorize.
• Which plan includes it?
  The Elite plan, including the Elite trial. 
• Where do I find the service account in xFanatical Foresight?
  Go to Settings > Security. The Service Accounts card is below Your connected accounts. You'll only see it on the Elite plan.
• What do I need before setting a service account up?
  • Google Workspace Super Admin approval. If you are not a Super Admin, you must ask a Super Admin to approve and complete the Domain-wide Delegation step in the Google Admin Console.
  • Google Workspace administrator privileges. Your Google account must have the privileges of Users > Read, Domain Management and Reports. These administrator privileges allow xFanatical Foresight to find and validate users in your organization's domains and check service account usage.
  • Sufficient Google Cloud project quota. xFanatical Foresight checks this automatically at the start of setup. Learn more about viewing and managing quotas in Google Cloud.
  • Google Cloud Project Creator role. Your Google account needs the Project Creator role in Identity and Access Management (IAM). If you see an error during the service account setup, contact your Google Workspace super admin or Google Cloud Organizational Administrator.
• Does xFanatical Foresight store a key for the service account?
  No. Security keys are never stored or displayed in xFanatical Foresight.
• Can I leave the page during setup?
  Yes. Setup continues in the background. You can come back at any time to check progress or finish the manual step.
• Will my existing rules be affected after the service account setup?
  No. Existing rules created function normally and are not affected by the service account setup. Automations that were already running keep running. The service account only adds new capabilities, such as acting on behalf of other users.
• How do I know if something is wrong with my service account?
  xFanatical Foresight checks the service account about every 2 hours. If a check fails, the status changes (for example, to Unauthorized), the rules that use it are disabled, and you get an in-app and email alert explaining what to fix. To check right away, click Check health now in Settings > Security > Service accounts.
• Do my rules start again after the problem is fixed?
  The service account goes back to Ready by itself at the next check after the fix. Disabled rules don't restart automatically, though. Turn them back on from the Rules page.
• Can I connect more than one service account?
  No. You can have one active service account per Google Workspace organization. To replace it, delete it and set up a new one.
• Can I pause automations without removing the service account?
  Yes. Disable the service account. Rules that depend on it are disabled, and their settings are kept. Enable the service account and dependent rules again when you're ready.
• What happens to my rules if the service account is disabled or deleted?
  Rules that use the service account are disabled, and their settings are kept. After you enable the service account again, or set up a new one, turn those rules back on yourself. They don't restart automatically.
• Will an unused service account be disabled automatically?
  Yes. If it has no automation activity for 60 days and no enabled rule uses it, it is disabled. You get a notice 7 days before this happens.
• How long do Domain Wide Delegation changes take?
  Usually a few minutes, but up to 24 hours. If your organization uses multi-party approval, another Super Admin may need to approve the change too.
• Can I automate for any user?
  No. The user must be active (not suspended, archived or deleted) and must belong to your organization's domain(s). External users can't be impersonated.
• How do I remove the service account completely?
  Delete it from Settings > Security > Service accounts. Then remove its Domain Wide Delegation entry in Google Admin console to fully revoke its access.
• Is Domain Wide Delegation safe?
  It is powerful because it can grant access to data across your domain. Authorize only the permissions (scopes) your rules need, and regularly review and remove scopes you no longer use. Learn more about Domain Wide Delegation.
• How to opt-out for emails and notifications related to Service Account ?
  Go to Settings > Notification. Under Security, find Service account alerts ("Service account status updates and issues"), and turn off Email, In-app, or both.