G-Suite Securlet is not importing very many users

Products

• CASB Securlet SAAS

Issue/Introduction

The G-Suite securlet imported only a small percentage of users into CloudSOC as seen in the CloudSOC users tab.

In this case, a few hundred users out of 1000's of users were added.

Cause

• The option to import users as active users was not checked.

• Another factor to consider would be if your GSuite account has internal users from multiple domains, ensure those domains are also added to your CloudSOC tenant prior to activating the Securlet. Otherwise, they will be treated as external users, and rescan will be required to add them as secondary domains.

Resolution

• The Securlet should be activated with the box checked for "Import as active users" if you intend to add the GSuite users to CloudSOC.

• Without the import users selected, only new GSuite Securlet users are added.

• If you already activated without the "import users" option selected, you will need to deactivate the Securlet (without data purge) and reactivate with the "Import as active users" option selected.

• If you intend to only monitor a subset of your GSuite users, use the 'Selective scan' option at the start of the Securlet activation form.

Additional Information

• The Securlet configuration will not display this setting after configuration.

• Support can verify if the box was checked by requesting the Securlet Engineering\Operations team to verify the back-end.