SafeToOpenEmail Security Docs

SafeToOpen Browser Security

Gmail: Google Workspace deployment

Marketplace domain install by organisational unit, sign-in without invites, Google Groups import, verification

Guide 3 of 7 · April 2026

Result: SafeToOpen appears in the Gmail side panel for the organisational units you choose, on the web and in the Gmail mobile apps, and each mailbox is licensed on first open. Time: about 15 minutes.

What you will need#

1. Install the add-on for the domain#

  1. admin.google.com → Apps → Google Workspace Marketplace apps → Apps list → Install app (or open https://workspace.google.com/marketplace/app/safetoopen_email_security/443049303936 and choose Admin install).
  2. Choose “SafeToOpen Email Security”, review the data access it requests (read the open message, act on it when the user asks, identify the user), and accept.
  3. Install for everyone, or for specific organisational units and groups. Users in scope cannot uninstall a domain-installed add-on.
  4. Optionally Apps → Google Workspace Marketplace apps → Settings → Allowlist to stop users adding other add-ons.
Note Google can take up to 24 hours to show a domain-installed add-on in every mailbox; in practice it appears at the next Gmail load.

2. Add the people#

Two routes. Directory import keeps membership in step with your Google Groups; the People page is for one-off additions.

2a. Import from Google Groups#

  1. Google Cloud console → IAM & Admin → Service Accounts → create one → Keys → Add key → JSON. Keep the file.
  2. Google Admin console → Security → Access and data control → API controls → Manage domain-wide delegation → Add new. Client ID: the service account’s. Scopes (read-only): admin.directory.group.readonly, admin.directory.group.member.readonly, admin.directory.user.readonly, admin.directory.customer.readonly (full URIs are shown on the console page).
  3. Console → Organisation → Google Workspace → Connect. Enter a label, the default workspace, the admin account the service account acts as (a super admin or a delegated admin who can read users and groups), and paste the key file whole. SafeToOpen checks the key against Google before saving.
  4. Map groups: for each Google Group choose the workspace’s seat type, Plus or Executive. A person in two mapped groups gets the higher seat. Save & sync.
  5. Invite emails: untick when the add-on is installed for the domain from the Admin console; the import then only assigns seats. Leave on if some people install the add-on themselves.

Google Groups do not push change notifications, so connections are polled hourly; use Sync for an immediate run. Leavers are removed and their seats freed, and can receive an access-removed email if you switch that on. A member added by hand or by another connection is never removed by this one. MSPs can connect several domains, each with its own label and default workspace.

2b. Add by hand or by CSV#

  1. Console → People → Add: paste addresses, or upload a CSV with columns email, seat (plus or executive) and workspace.
  2. Untick “Send invite emails” for a domain install; the add-on is already in their Gmail and licensing happens on first open.

The Gmail add-on identifies the user by their signed-in Google account. The address is matched to the member on first open, whether they were added before or after their first sign-in, and the member becomes active.

3. Verify#

  1. On a test mailbox, open Gmail on the web, open a message, and click the SafeToOpen icon in the right side panel (the icons strip; click the » arrow if the panel is collapsed).
  2. The panel shows your branding and a score without a sign-in prompt.
  3. Console → People shows the member as active; a report from the panel appears under Incidents within a minute.

4. Policies and branding in Gmail#

Workspace policies apply to the Gmail panel as they do to Outlook: automatic Deeper Analysis, auto-forward of Dangerous verdicts, result labels (the personal labels toggle is greyed out when the policy sets it), the URL scan service, and branding (name, logo, tagline, colours). Auto-scan links and security tips have no Gmail equivalent, and the add-on name comes from the Marketplace listing. Guide 4 has the full table.

5. Mobile#

Workspace add-ons run in the Gmail apps for Android and iOS. The user opens a message and taps the SafeToOpen card at the bottom of the message. Nothing extra to deploy.

6. Removing#