WOSP

WOSP (Workspace Operations & Security Portal) is a portal MSPs run to manage their customers’ Google Workspace, much as CIPP does for Microsoft 365. Each customer is a WOSP tenant, and WOSP acts in that customer’s Google Workspace for you. Connect your WOSP, and Neo agents can work Google Workspace tickets from the PSA: offboard a leaver, give a manager access to a mailbox, or check an account that looks compromised.

​

What Neo can do with WOSP

• Users: find a user, suspend, restore, archive or delete them, sign them out of every session, set a new password, add aliases, and change their org unit and profile
• Groups: create and rename groups, add and remove members, change a member’s role, and set who can join and post
• Gmail: set out of office, IMAP and POP, and forwarding; give or remove mailbox delegate access; add send-as addresses; remove Gmail filters
• Licences: read assignments and seats, and assign or remove a licence
• Devices: read ChromeOS and mobile devices and managed Chrome browsers, and disable, approve or block a device
• Drive: read storage and shared drives, create a shared drive, add and remove members, and move a leaver’s Drive files to another user
• Security: read Google Workspace alerts, WOSP’s audit findings, admin roles and the apps users granted access to; revoke an app’s access; read sign-in and admin audit reports
• WOSP itself: read each tenant’s last collection, run collection again, and start onboarding a new customer

There is no WOSP call that creates a Google Workspace user. Create a new starter in the Google Admin console; Neo then sets their org unit, groups, licence and aliases. See WOSP API for the permission groups.

​

Your tenants are mapped to your PSA companies

Neo matches your WOSP tenants to the companies in your PSA and keeps the mapping on the WOSP card’s Organization Mapping tab, refreshed on each PSA metadata sync. Matching uses the tenant’s alias first (set it in WOSP to the customer’s name in your PSA), then its company name: exact, then after stripping a legal-form suffix (Ltd, Inc, LLC). Next comes the domain of the tenant’s admin email against a PSA company’s website. Last comes an AI match for the long tail. An exact name match, or one you confirm, is handed straight to your agents. A match after stripping a legal-form suffix, a domain match or an AI match is not handed to your agents automatically. It shows on the Organization Mapping tab, where you can confirm or correct it. Anything Neo could not match stays unmapped and visible on the same tab, where you can set the right company by hand. A mapping you set by hand survives every later sync. A tenant you hide from the API in WOSP is not listed. On a ticket, an agent works in WOSP only on the tenant mapped to the ticket’s company. A company with no mapping that agents can use gets no WOSP calls until you set or confirm one on the tab. Agents with no ticket, such as a chat or a scheduled report, reach every tenant.

​

What Neo never does

Neo never reads or sends a tenant’s Google service-account key, never creates or revokes WOSP API keys, never changes WOSP’s own settings, and never re-seeds the WOSP install or opens the Google or Microsoft consent pages of WOSP’s onboarding and sign-in setup. It always asks a technician before it renames, updates or deletes a tenant or hides it from the API, wipes or deprovisions a device, or saves WOSP’s Entra or Google OAuth sign-in setup.

​

Next steps