--- title: "Virtual identities on your Google Workspace domain · Selan" description: "Connect your Google Workspace, prepare Cloud Identity Free, then create, reset and delete Google accounts for agents. Owner-only, with its limits." url: https://selan.ai/docs/virtual-identities updated: 2026-11-01T12:37:45+02:00 --- Agents Docs · Virtual identities # Google identities on your company's domain Create a separate Google account for an agent without assigning it a paid Google Workspace licence. Your company connects its own Workspace, and the accounts stay in its directory. Only Selan owners can manage them. What you get ## What is a virtual identity? A virtual identity is a Google account such as `agent-1@example.com`, on the domain of the Workspace your company connects. Selan creates it in `/Selan virtual identities` and checks that it has Cloud Identity Free without a paid Workspace licence before reporting creation as successful. Use one when an agent needs a Google identity separate from a person's account. Cloud Identity Free provides identity management without a paid Workspace licence; it does not include a Workspace Gmail inbox. Google sign-in at another service still depends on that service's sign-in options and your organisation's policies. The identity does not include a subscription or seat at another provider, or permission to use an agent there. Check that provider's terms and your company's rules before creating an account or buying a seat. Creating the Google account does not sign it in to another service. **Virtual identities** is a separate menu item immediately after **Tokens** in [Selan control](https://control.selan.ai/virtual-identities). It is available to owners of every Selan company. Ordinary members do not need to use this feature or change how they sign in to Selan. ## What do you need before connecting? - A Selan owner account in the company you want to connect. - A super administrator account for that company's Google Workspace. A personal Gmail account cannot connect a Workspace. - Permission to add Cloud Identity Free and change licensing for the identities' organisational unit in Google Admin. On 1 November 2026 Selan submitted its Google Workspace app for Google verification. Google has verified the app's branding, and its data access is under Google review. Until Google approves it, Google may still show an unverified-app warning, and your organisation's app-access policy or Google's limits may prevent consent. The menu being available does not mean every Workspace can connect. If consent is blocked, ask your Workspace administrator and [contact Selan](https://selan.ai/contact); do not weaken your organisation's security policy to proceed. Set up your Workspace ## Connect your company's Google Workspace 1. Open [Virtual identities](https://control.selan.ai/virtual-identities) as a Selan owner. 2. Choose **Connect Google Workspace**. 3. On Google's consent screen, select a super administrator of the Workspace you intend to connect. 4. Review and approve all the requested permissions, then return to Selan's setup checklist. Selan requests access to manage directory users, organisational units and licences, to read your Workspace's domains, plus the approving account's email address. These are administrative permissions, not access limited by Google to one unit. Selan uses them for this feature's unit and creates `/Selan virtual identities` if it is missing. The checklist shows whether Selan can reach Google and whether Cloud Identity Free is on. If a check fails, follow its Google Admin link or choose **Connect again** when Selan asks you to renew access. If you left out a permission, start the connection again and review the full request. A connection approved before Selan asked to read domains offers only its own connected domain. When that applies, **Create virtual identity** says Selan can only see that domain until you approve its access to your domains again, with an **Approve domain access** button that reopens Google's consent. ## Set up Cloud Identity Free before creating an identity 1. In [Google Admin, Billing, Buy or upgrade](https://admin.google.com/ac/billing/catalog), choose **Cloud Identity**, then **Cloud Identity Free**, and complete Google's setup. Choose Free, not Premium. 2. Open [Billing, License settings](https://admin.google.com/ac/billing/licensesettings). Select **Selan virtual identities** and turn automatic licensing **off** for each Google Workspace subscription that would otherwise give those users a paid licence. Override the parent unit's setting for this unit; leave the rest of your company's licensing as intended. 3. Return to Selan. Use **Check again** if offered, then create the first identity once the grant and Cloud Identity Free checks pass. The automatic-licensing step stays unconfirmed until Selan creates an identity and checks its licences. **Check again** does not verify that Google Admin setting. A successful creation confirms that the new account holds Cloud Identity Free and no paid Workspace licence at that check; it is not continuous monitoring. If Google assigns a paid Workspace licence, Selan attempts to delete the new account and tells you to fix automatic licensing before retrying. If cleanup fails, the error tells you to delete the account in Google Admin. Do not rely on this check instead of setting up licensing first. Cloud Identity Free has no licence charge. The number of accounts your tenant can create depends on Google's entitlement and your other subscriptions. Check capacity under **Billing, Subscriptions** in Google Admin; Selan does not show a remaining-licence counter. If you reach the limit, follow Google's process to request an increase. Approval is Google's decision. Turning automatic licensing off does not remove existing paid licences or cancel subscriptions. See Google's instructions for [adding Cloud Identity](https://docs.cloud.google.com/identity/docs/how-to/set-up-cloud-identity-admin), [licensing by organisational unit](https://knowledge.workspace.google.com/admin/billing/about-automatic-licensing-for-organizational-units?hl=en) and [Cloud Identity entitlements](https://docs.cloud.google.com/identity/docs/how-to/how-licensing-works-for-cloud-identity). Manage identities ## Create an identity and copy its credentials 1. Choose **Create virtual identity**. 2. Enter the part before `@`, such as `agent-1`. If your Workspace has more than one verified domain, choose one in the **Domain** list beside the name; with one, Selan supplies it. Selan lists primary and secondary domains, not domain aliases, and refuses a domain Google does not report as verified. Use letters, numbers, dots, dashes or underscores, starting and ending with a letter or number. 3. Choose **Create** and wait for the Google account and licence checks. 4. Copy the username and generated password while the result is open. Store the password in your company's approved password manager. Selan shows the password once and does not store it. Closing the result loses access to that password in Selan. **Open identity** appears once Google lists the new account. The list shows each identity's address and creation date, read from the connected Google directory, and a **Used by** column. It can include accounts placed in the unit outside Selan. Listing an account does not certify its current licences; check those in Google Admin, especially if someone has changed them since creation. If creation times out or its result is unclear, check Google Admin for the requested address before retrying. An interrupted response does not prove that Google failed to create the account. Review its licences there and remove any unwanted account. ## Set a new password Open an identity from its row, then choose **Show new password**. This sets a new password at Google; it does not reveal the old one. The old password stops working. Copy the new one before closing the result, and update wherever your company keeps it. ## Delete the Google account Open the identity, choose **Delete identity**, and confirm. This deletes the actual Google account, not just its row in Selan. Access at services that depend on that account can be disrupted; review those services' sessions and recovery options rather than assuming deletion immediately ends every session. Deleting the Google account does not cancel subscriptions or remove seats it holds elsewhere. Remove those at each provider and remove any connected credential you no longer need on **Tokens**. ## What does Used by show? **Used by** lists the connected provider accounts on **Tokens** whose sign-in address is the identity's address, one name per provider (Claude or OpenAI). The address is the one the provider reports for the account, not one typed in or guessed from a token's name. It does not list people, agents or platforms, which Selan does not record. Kimi accounts do not appear yet, because Selan has no verified account address for them. An existing ChatGPT account fills in after its next health check, and an existing Claude account after its next token renewal or when you relink it. A dash means no connected account matches. Check it before you delete an identity, since deleting the Google account stops those sign-ins working. ## Manage identities from an AI assistant Connected to [Selan's MCP server](https://selan.ai/docs/mcp), a company owner's assistant can use six tools: `selan_virtual_identity_status`, `selan_virtual_identities_list`, `selan_virtual_identity_detail`, `selan_virtual_identity_create`, `selan_virtual_identity_reset_password` and `selan_virtual_identity_delete`. They are for the signed-in owner only, reads included. Edit and read members do not see them, and CLI or agent tokens are refused even when they belong to an owner. The company always comes from the signed-in session. Connecting Google stays on Control: the status tool tells the owner to open Virtual identities and sign in to Google as a Workspace admin, and nothing is connected until that finishes. A new or reset password appears once, in the create or reset tool's result, and never in status, list or detail. Delete is permanent, and a reset stops the old password at once. There is no bulk operation and no assigning an identity to a platform. ## Connect provider accounts separately on Tokens Once your company has confirmed that a provider permits the intended use, complete that provider's sign-in and any subscription setup yourself. Use the existing **Tokens** flow to connect a supported provider credential to Selan. [Models and providers](https://selan.ai/docs/providers) describes those connections. Virtual identities manages Google accounts. Apart from the Used by column, it does not track where they sign in, and it does not assign them to an agent or team. Successful Google sign-in alone does not establish that a provider supports the intended agent use or that a plan includes it. ## What access and information does Selan keep? Selan keeps the Workspace admin's refresh token encrypted, the connected domain and Google customer identifier, who approved and connected it, when it was connected, and the last licensing-check result. For identities made through Selan, it records the Google user identifier, creator and creation time. The account list comes from Google. Creation, password reset and deletion are logged with the company, acting owner and Google user identifier. Generated passwords are not stored. To revoke the admin grant, remove Selan's access in your [Google account permissions](https://myaccount.google.com/permissions) or your Workspace app controls. Revocation prevents further authorised API access; it does not delete existing identities or the connection record in Selan. There is no disconnect action on this page. [Contact Selan](https://selan.ai/contact) to request deletion of the stored connection. See [Privacy: virtual identities](https://selan.ai/privacy#virtual-identities).