Realsmart Help

All guides / Sync

Google Workspace settings

Google Workspace settings connect a school to its Google domain and control what Realsmart provisions there. They live under Google Workspace in the sidebar, split into sub-areas so each setting has one clear home: Settings (this page — connection and what to sync), OU settings, Classroom and Groups. Two more items in the same group have their own guides: Launchpad widgets (where your school has them) and Calendar sync — see Launchpad widgets and Google Calendar timetable sync.

The Google Workspace group only appears in the sidebar while Google sync is switched on for the school. If you can't see it, switch Google on first under School settings → Sync services — the Configure → link beside Google Workspace there opens this page too.

Google Workspace enabled, at the top of the Connection section, is the master switch: with it off, nothing syncs to Google for the school no matter what the rest of the page says. It is the same switch as Google Workspace on the Sync services tab of School settings — change it in either place and both update. See Enable or disable sync services. That tab also lets you run Google in preview — the sync plans what it would do and changes nothing in Google — before switching to Live. Everything else on this page controls how Google sync behaves once it is on and live.

Before you start

  • You must be a school admin with sync settings permission, with a school selected in the switcher.
  • You will need your school's Google primary domain (e.g. school.org) and a Google admin account to sign in with.
  • Setting up the underlying access (below) is a job for whoever administers your Google Workspace / Google Admin console. If that is not you, share the "access the service account needs" section with them.

Steps

Step 1: Open Google Workspace settings

In the sidebar, open Google Workspace → Settings. The Connection section is shown first; a section switcher lets you move between Connection and Sync. The page reopens on the section you used last, and the section is in the page address (?section=), so a link you copy opens on it.

Step 2: Enter the connection details

The Connection section is split into Service, Domains and Admin account. Fill in:

  • Google Workspace enabled — the master switch described above. Leave it on for a school that syncs to Google.
  • Primary domain — your main Google Workspace domain, e.g. school.org. The sync's admin account lives on this domain. If you leave Secondary domain blank, your users' and groups' Google addresses end in this domain too.
  • Secondary domain — only if your school uses a second verified domain in the same Google tenant (for example, each school in a trust has its own sub-domain). When it is set, your users' and groups' Google addresses are created on this domain instead. Leave blank if you have just one.
  • Admin user — the username of a Google super administrator account: just the part before the @, for example realsmartadmin. The sync adds your Primary domain to work out the full address it acts as ([email protected]) — so don't type the full address, even though the box shows [email protected] as an example. Make sure the account really is a super administrator in Google.
  • Admin password — this box always opens empty, with "Leave blank to keep current" in it. The stored value is never shown. Leave it blank to keep the stored password; only type in it when you need to replace it.

Step 3: Choose what to sync

Switch to the Sync section and turn on the parts you want Realsmart to keep in step with Google. The section is split into three blocks — Passwords, Groups and Classroom, and Profile details — so related switches sit together.

User accounts themselves have no separate switch: while Google Workspace enabled is on, Realsmart creates, updates and suspends Google accounts to match Realsmart. The blocks below narrow what else is written.

Passwords — see Choose who password sync applies to below.

Groups and Classroom

  • Sync groups — provision Google groups and their membership. Turn it off to hold every group change back for this school; user accounts are unaffected.
  • Group types to sync — narrow which kinds of group go to Google; see Choose which group types sync.
  • Don't sync Classroom teachers — stop the sync putting your staff into the domain's classroom_teachers@ Google group (the group Google Classroom uses for teacher permissions). It doesn't change who is a teacher on any class — class rosters follow each group's members; see Add a teacher to a Google Classroom.

Profile details

  • Sync mentor profile pictures / Sync learner profile pictures — send pictures added in Realsmart itself up to Google for staff and/or students. Turning these on doesn't start an automatic copy: Realsmart support runs that copy when it's needed. To copy photos from your MIS instead, see Get pupil and staff photos from the MIS into Realsmart and Google.
  • Sync organisation profile — writes your school's name as each staff member's organisation, and their job title, into their Google Workspace profile. Learners are never included.

Choose who password sync applies to

Two controls in the Passwords block decide whose Google passwords Realsmart is allowed to change.

  • Sync passwords to Google — the school-wide switch. Push password sets/resets from Realsmart to Google. Turn this off if your school manages Google passwords elsewhere and you do not want Realsmart to change them: existing users then keep whatever password they have in Google, and password changes in Realsmart are not pushed. Two things still happen with it off — new Google accounts are always created with their initial Realsmart password (Google requires one), and if you later turn the switch back on, each user's current Realsmart password is pushed on their next sync so the two sides line up again.
  • Skip password sync for these user types — carve-outs for individual kinds of user, so you do not have to choose between "everyone" and "nobody". Tick Students, Staff, Admins, Governors or Observers and those users keep whatever password they already have in Google, even while the switch above is on. Everyone else still syncs as normal.

A worked example: to push student passwords to Google but leave staff and admin passwords alone, leave Sync passwords to Google on and tick Staff and Admins.

The same two exceptions apply per type as they do to the school-wide switch — a brand-new Google account for an excluded user is still created with its initial Realsmart password, and unticking a type again pushes each affected user's current Realsmart password on their next sync. Leave every type unticked to sync passwords for everyone — that is the default. Ticking types has no effect while Sync passwords to Google is off, because nothing is being pushed anyway.

Choose which group types sync

With Sync groups on, Group types to sync lets you narrow which kinds of group go to Google, instead of all of them. Tick any combination of:

  • Teachers of — the "teachers of" groups.
  • Houses — house groups.
  • Registration groups — registration / form groups.
  • Role groups — the fixed role groups (learners, mentors, teaching staff, non-teaching staff, governors, observers, Ofsted).
  • Year groups — year-group cohorts.
  • Subjects — subject groups from Provision Subjects.
  • Groups — the catch-all: classes and anything else, including groups you create by hand and any group that hasn't been classified into a type yet.

Leave every type unticked to sync them all — that's the default and matches how Google sync behaved before this option existed. This filter only takes effect while Sync groups is on. A per-group opt-out (Sync this group to Google on the group itself) still applies underneath — a group syncs only if its type is selected here and it's opted in. This is the same taxonomy as the Entra selector, so a trust can scope both platforms the same way.

Ticking Groups (or leaving every type unticked) also picks up any group that has no type set yet — a backstop so an unclassified group never silently drops out of sync. The other types match only their own kind.

Deselecting a type is not a purge: Realsmart simply stops managing that type in Google, leaving any groups it already created in place.

Preview which groups will sync

Below the type checkboxes, Groups that will sync previews exactly which groups match your current selection for this school — grouped by type, with a count you can expand to see the group names. It updates live as you tick and untick types, before you save. It's hidden while Sync groups is off.

Step 4: Save, then test the connection

Select Save settings (you'll see "Google Workspace settings saved."). Then confirm the connection actually works using Sync status → Test connection in the sidebar — it does a read-only check with the real credentials and never changes anything. See Test connection / Test permissions.

This page is per school — in MAT overview it asks you to switch to a school first. If you are a trust admin, Apply across MAT (top right of the page), or Platforms → Google settings in MAT overview, copies chosen Google settings to other schools in one go — only the settings that can be shared, never a school's own domain or admin account. See Apply sync settings across the trust.

How the connection works: service account and domain-wide delegation

You do not paste a secret key into Realsmart for Google. Instead, Realsmart's provisioning runs as a Google service account — a non-human Google identity — and your Google administrator grants that service account permission to act inside your domain. This is called domain-wide delegation.

In practice, your Google administrator does this once, in the Google Admin console (under Security → Access and data control → API controls → Domain-wide delegation): they add Realsmart's service account client ID and authorise it for the specific scopes listed below. Realsmart support can give you the client ID — it isn't shown on this page (the launchpad reader's own client ID is, on Launchpad widgets). The admin user you entered above (with your primary domain) is the account the service account impersonates when it works in your domain.

If the connection test reports a missing capability, it almost always means one of these scopes has not been authorised yet — re-authorise the service account for the missing scope in the Google Admin console.

The access the service account needs (scopes)

These are the exact Google API scopes the sync uses. Your Google administrator authorises them for Realsmart's service account when they set up domain-wide delegation. Grouped by what they are for:

Directory (users, groups, organisation units)

  • https://www.googleapis.com/auth/admin.directory.user
  • https://www.googleapis.com/auth/admin.directory.group
  • https://www.googleapis.com/auth/admin.directory.orgunit
  • https://www.googleapis.com/auth/apps.groups.settings

Google Classroom

  • https://www.googleapis.com/auth/classroom.courses
  • https://www.googleapis.com/auth/classroom.coursework.me
  • https://www.googleapis.com/auth/classroom.coursework.students
  • https://www.googleapis.com/auth/classroom.rosters
  • https://www.googleapis.com/auth/classroom.announcements

Drive and Calendar

  • https://www.googleapis.com/auth/drive
  • https://www.googleapis.com/auth/calendar
  • https://www.googleapis.com/auth/admin.directory.resource.calendar — rooms and other bookable resources, for calendar sync's room booking

Licences — used to move suspended accounts onto a lower Google Workspace licence:

  • https://www.googleapis.com/auth/apps.licensing

Gmail — used by the launchpad to show each person their unread email count:

  • https://www.googleapis.com/auth/gmail.readonly

Classroom guardian links — additionally used when managing Google Classroom guardian (parent) invitations:

  • https://www.googleapis.com/auth/classroom.guardianlinks.students

Grant the full list even if you do not use every feature today — missing a scope only shows up later as a failed capability in the connection test. If your school does not use Classroom, its scopes simply go unused.

The launchpad reader

The live Google widgets on the launchpad (Due work, To review and My classes from Classroom; My calendar, School calendar and Unread mail from Calendar and Gmail) can read Google through a second, separate Realsmart connection: the launchpad reader, a service account of its own that holds only read-only scopes. Your Google administrator authorises it once, in the same Domain-wide delegation screen, with its own client ID and scope list. Without it, the widgets use the connection above: its Classroom and Calendar scopes, and gmail.readonly for Unread mail. Where your school has the widgets, the reader's client ID and scopes are shown on Google Workspace → Launchpad widgets, ready to copy — see Launchpad widgets.

The other Google sub-areas

The rest of the Google settings have their own pages so they stay manageable:

  • OU settings — the organisation-unit roots for learners and mentors and the path templates that decide where each account is placed. See Google OU settings.
  • Classroom — provision Google Classroom, Classroom reporting, the fallback owner for orphaned classes, and what happens to classrooms between years. See Google Classroom settings.
  • Groups — the default membership role mentors get in Google groups. See Google group settings.

What's on the Sync tab now

The Sync tab of School settings holds the remaining MIS/provisioning options — Fetch groups from MIS, Add all mentor roles as cohort members, Import parents, MIS profile pictures, Purge retention, the provisioning date window — plus the Pre-admission, Pending mentors, Teachers of groups and Subject groups cards. Google-only options such as Sync organisation profile live here under Google Workspace → Settings, not on that shared Sync tab. See What each option on School settings → Sync does.

Troubleshooting

  • "Google Workspace isn't in my sidebar." Google sync is off for the school. Switch it on under School settings → Sync services (or open Configure → there).

  • Logs show "… SKIPPED — the Realsmart admin account … " and nothing reaches Google. Every Google sync impersonates the admin user you entered (on your primary domain). Before the directory sync, the Classroom sync and the Classroom reporting import, Realsmart checks that account still works and stops, with one error row, when it doesn't. The row names the account and what's wrong, and ends "Nothing was sent to Google. Fix: reactivate the account in the Google Admin console (Directory > Users), make sure it is still an administrator, and exclude it from any policy that suspends inactive accounts. The next sync catches up on its own." The reason is one of:

    • "… is suspended in Google Workspace" (or "is archived in Google Workspace") — reactivate it in Google Admin.
    • "… is no longer an administrator in Google Workspace" or "is not allowed to administer the domain any more — it has lost its administrator role" — make it a super administrator again.
    • "… could not be signed in to — Google refused it …, which means it has been suspended, deleted or renamed" — check the Admin user here matches the real account name (and the Primary domain is right), and that the account exists and is active.
    • "… Google says Realsmart's domain-wide delegation is no longer authorised for this domain" — your Google administrator needs to re-add Realsmart's client ID and scopes under Security → Access and data control → API controls → Domain-wide delegation.

    Then run Sync status → Test connection to confirm. See Test connection / Test permissions.

  • Users or groups get the wrong domain on their address. Addresses use the Secondary domain when one is set, otherwise the Primary domain. Clear the secondary domain if your school only has one.