Capabilities
Query Tools
| Tool | What It Does |
|---|---|
| Analyze user security | Security posture analysis: 2FA coverage, admin accounts, recent users |
| List users | List users with status, admin flags, 2FA enrollment |
| Get user details | Detailed user info: status, 2FA, recovery info, aliases, last login |
| List groups | List all groups with member counts |
| Get group members | View members by role (owner, manager, member) |
| Get login failures | Recent failed login attempts grouped by user and IP |
| List third-party apps | OAuth apps connected to user accounts with permission analysis |
| List org units | Organizational unit hierarchy |
What Hiro Cannot Do
- Cannot suspend or disable users
- Cannot wipe devices
- Cannot reset passwords
- Cannot revoke OAuth tokens
- Cannot modify group membership
- Cannot change any settings
Setup
Prerequisites
- Google Workspace admin access
- Business, Enterprise, or Education plan
Connection Method
Hiro connects via OAuth 2.0 with admin consent.Start connection
In Hiro, go to Settings > Integrations and click Connect.
Sign in with admin account
You’ll be redirected to Google. Sign in with a Google Workspace admin account.
Grant permissions
Review and approve the requested permissions. All scopes are read-only:
- Directory API (users, groups, org units, devices)
- Reports API (login activity, admin activity, token activity)
Investigation Examples
Security posture analysis
- Total users (active, suspended, archived)
- Users without 2FA enabled
- Admin users and their 2FA status
- Recently created users (last 30 days)
- Security findings with severity levels
Check a specific user
- Account status
- 2FA enrollment
- Last login time
- Admin privileges
- Email aliases
- Recovery information
Find login failures
- Failed attempts grouped by user
- IP addresses used
- Recommendations for accounts with many failures
Audit third-party apps
- Apps categorized by risk level:
- High risk: Full email or Drive access
- Medium risk: Calendar or contacts access
- Low risk: Limited permissions
- Scopes/permissions for each app
- Number of users with each app
Security Analysis
Hiro’s security analysis highlights:| Finding | Severity |
|---|---|
| Admin without 2FA | Critical |
| Many users without 2FA | High |
| Recently created admin accounts | High |
| High-risk third-party apps | Medium |
Limitations
Since the integration is read-only:- For user issues — Suspend users manually in Admin Console, or use Okta if users are provisioned through Okta
- For device issues — Wipe devices manually in Admin Console
- For app issues — Revoke OAuth tokens manually in Admin Console
Troubleshooting
”Admin access not verified”
The account used to connect may not have sufficient admin privileges. Reconnect with a Super Admin account.Slow queries
Google Workspace APIs can be slow for large domains. Queries may take several seconds.Missing data
Some report data requires specific Google Workspace editions. Check your license level.Next Steps
Okta
Connect identity management for user actions.
Slack
Connect team communication.