domainwidedelegation.comGet it set up

Use cases → Admin and governance

Synchronize contacts across Workspace tenants

Keep user and shared contacts in sync between Google Workspace directories using a delegated service account.

Who it is forIT administrators responsible for multi-tenant contact consistency.
APIsAdmin SDK
Typical scopesadmin.directory.user, admin.directory.user.readonly

The problem

When organisations operate across several Workspace tenants, contact information diverges and manual updates never scale. Out-of-date directory entries lead to mail delivery failures and missed connections.

How it works

  1. Authenticate with a domain-wide delegated service account in each tenant.
  2. Fetch the user and shared contact lists from the source tenant.
  3. Compare with the destination tenant’s directory and compute diffs.
  4. Update, add, or remove contacts in the destination tenant accordingly.

What changes

Directory entries remain aligned across tenants, reducing confusion and ensuring everyone is reachable by address or name lookup.

The trap in this one. The Admin SDK's contact changes can take hours to propagate to the global address list and may not appear in autocomplete immediately. Engineers often mistake API success for immediate user visibility; always test from an end-user account after sync, or you’ll chase cache ghost issues for days.

Watch it explained

“Connect Google Sheets API in 60 Seconds!✨ Please subscribe to support and help” — SaveMyCode on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Can I sync custom attributes or only basic fields?

Custom fields are supported, but you must explicitly map and handle each one. Unmapped fields are silently dropped.

How do I handle deleted users?

You must explicitly remove their contact cards—otherwise, deleted accounts linger as ghosts and confuse search results.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Audit which third-party apps can read your mail

List every OAuth grant across the domain and find the retired tools still holding access.

Automate joiners, movers and leavers

Create accounts, set group membership, provision Drive and hand over mailboxes without a manual checklist.

Continuously verify your delegation still works

A scheduled probe that proves every API still answers under every tenant, before a customer finds out otherwise.