Short answer: In the Google Admin console, go to Menu → Apps → Google Workspace Marketplace apps → Apps list, click Install app, search for ExpenseBot, choose Admin install, review the data access, and install it for Everyone at your organization (or a specific organizational unit / group). Because you're doing an admin install, your users get access without each having to click through an individual consent screen. Changes can take up to 24 hours to propagate.
You can also start from the ExpenseBot Google Workspace Marketplace listing and choose Admin install there.
Step-by-step: install for everyone
- Sign in to the Google Admin console as a super admin.
- Go to Menu → Apps → Google Workspace Marketplace apps → Apps list.
- Click Install app and search for ExpenseBot.
- Select ExpenseBot, click Admin install, then Continue.
- Review the data access the app requests and the developer's policies.
- Choose Everyone at your organization (or Certain groups or organizational units to scope it — see the pilot pattern below).
- Click Finish.
Menu labels above are Google's current wording; Google occasionally renames these screens, so if a label differs, look for the nearest equivalent under Apps → Google Workspace Marketplace apps.
Allowlisting if your org restricts third-party apps
If your organization blocks third-party apps by default (a common security posture), admin-installing ExpenseBot isn't enough on its own — you also mark it Trusted so its OAuth scopes are allowed:
- Go to Menu → Security → Access and data control → API controls.
- Click Manage App Access (Manage Third-Party App Access).
- Under Configured apps, click Configure new app.
- Search for and select ExpenseBot.
- Set the access level to Trusted and complete the configuration.
API controls override the Marketplace allowlist, so setting ExpenseBot to Trusted here is what lets it access the Google services it needs when your org restricts unconfigured apps.
What scopes it asks for, and why
ExpenseBot requests the narrowest scopes that do the job:
- Gmail read-only — to find receipt-like messages (vendor names, totals, attachments) so it can capture receipts and income notifications. It doesn't scan your inbox broadly.
- Gmail modify (labels only) — used only to apply ExpenseBot's own "Processed" / "Receipt" labels so the same message isn't processed twice.
- Drive / Sheets file creation (
drive.file) — ExpenseBot can only see files it creates. Every user's receipts, reports, and spreadsheet live in that user's own Google Drive — ExpenseBot cannot list, read, or modify anything it didn't create.
ExpenseBot is Google CASA Tier 2 certified (an annual, OWASP-based security assessment through Google's assessment partner) for its use of Gmail and other sensitive scopes.
Roll out to a pilot OU first (recommended)
For a low-risk deployment, install to a small organizational unit or group first (step 6 → Certain groups or organizational units), let that pilot group connect their Gmail and run a scan for a week, then widen the install to Everyone at your organization once you're comfortable. This is the pattern most admins use for new Marketplace tools.
Common admin questions
Can I install it for just one department? Yes. At the install step choose Certain groups or organizational units and select the OU or group instead of Everyone.
Do users have to grant access individually after a domain install? For an admin-installed app, Google's documented behavior lets the domain install bypass the individual consent screen, so users generally don't each approve permissions themselves — the admin grants access on their behalf. Each user still connects their own account (and their data stays in their own Drive) the first time they open ExpenseBot.
Where does the data live? In each user's own Google Drive and Google Sheet — not on ExpenseBot's servers. Because the Drive scope is drive.file, ExpenseBot only ever touches the files it created for that user.
Related
- ExpenseBot for Google Workspace — how the whole integration fits together
- Google Workspace Expense Management — why Workspace-native teams skip corporate-card platforms
- ExpenseBot on the Google Workspace Marketplace