Skip to content
Event Route Optimiser Docs

Customer Google Sign-In Post-Onboarding Automation Runbook

Customer Google Sign-In Post-Onboarding Automation Runbook

1. Purpose

Define the automation handoff after one-time manual Google sign-in onboarding is complete and pilot sign-in is validated.

This runbook standardizes how Synkronyx automates group lifecycle, membership synchronization, and validation checks for customer tenants.

2. Entry criteria

Automation can start only when all criteria are true:

  1. Manual onboarding checklist is complete.
  2. Pilot user sign-in test passed.
  3. Break-glass account sign-in test passed.
  4. Local fallback sign-in test passed.
  5. Customer change approval is recorded.

3. Control model

  1. Entra groups are the source of truth for workforce lifecycle.
  2. Google groups are target objects for Google-side authorization.
  3. Synchronization is one-way from Entra to Google unless explicitly approved otherwise.

4. Required automation credentials

4.1 Customer-provided Google credentials

Customer must provide:

  1. Google service account identifier used for Admin SDK operations.
  2. Domain-wide delegation approval for required scopes.
  3. Delegated admin user email for automation.
  4. Secret reference for service account credential material.

4.2 Synkronyx-provided Entra credentials

Synkronyx must provide:

  1. Entra app registration for Graph automation.
  2. Tenant-scoped credential with least privilege.
  3. Secret or certificate reference in approved secret store.

5. Minimum permission set

5.1 Google side minimum permissions

  • Group create and update.
  • Group membership create and update.
  • Read access for user and group lookup.

5.2 Entra side minimum permissions

  • Read group definitions.
  • Read group memberships.
  • Read user identity attributes required for group sync.

6. Group mapping contract

Use a deterministic mapping file with explicit source and target group names.

Minimum schema:

groupMappings:
  - sourceEntraGroup: ""
    targetGoogleGroup: ""
    mode: "mirror"

Rules:

  1. Every mapping entry must be unique.
  2. Every target Google group must be pre-approved by customer security owner.
  3. Deletion behavior must be explicit and disabled by default.

7. Execution phases

7.1 Phase A: Preflight

  1. Validate credentials can authenticate to Entra and Google.
  2. Validate target tenant and domain values.
  3. Validate mapping file structure.
  4. Generate a preflight report.

7.2 Phase B: Dry run

  1. Compute group creation actions.
  2. Compute membership additions.
  3. Compute membership removals.
  4. Export planned actions without writing changes.

7.3 Phase C: Apply

  1. Create missing Google groups.
  2. Add missing Google group memberships.
  3. Remove out-of-policy memberships only when customer approved removal mode.
  4. Write audit log with correlation ID.

7.4 Phase D: Validate

  1. Re-read Google groups.
  2. Compare observed state to expected state.
  3. Publish pass or fail summary.

8. Rollback model

Rollback must support:

  1. Restore memberships from pre-apply snapshot.
  2. Disable sync execution schedule.
  3. Revert mapping changes made in current release.

Rollback trigger conditions:

  1. High-impact mismatch in group membership.
  2. Authentication failure during apply.
  3. Customer request to halt deployment.

9. Logging and evidence

Every run must produce:

  1. Preflight report.
  2. Dry-run action report.
  3. Apply action log with correlation ID.
  4. Validation report.
  5. Final status summary.

Evidence must be stored in the deployment record.

10. Operational cadence

Recommended cadence:

  1. Hourly sync during pilot.
  2. Every 15 minutes after production stabilization.

Cadence must be approved by customer security and operations owners.

11. Security guardrails

  1. Secrets must be read from approved secret store only.
  2. Credentials must not be printed in logs.
  3. Automation identity must use least privilege.
  4. Emergency stop must be available through configuration flag.

12. Handoff checklist

Synkronyx can mark automation handoff complete only when:

  1. Mapping file approved by customer.
  2. Dry run accepted by customer.
  3. Apply run passed validation.
  4. Rollback drill completed once.
  5. Customer operations owner signed off.