How do I turn on SaaS Discovery?
Discovery is off until you enable it on a connected source. The switch lives with the integration that supplies the data, not on the SaaS Discovery page, which is the one thing people reliably fail to find.
In this guide
Before you begin
You need Admin access to integration settings.
Google Workspace must already be connected. Until it is, the Discovery syncs tab tells you so and nothing else on this page applies. Connecting Google Workspace is covered under Integrations → Directories in the helpcenter.
Which sources feed discovery
Two, today:
| Source | What it contributes |
|---|---|
| Google Workspace | Single sign-on logins and OAuth grant activity — the main source, and the one you switch on here |
| AI usage telemetry | Per-person usage reported by AI services you have set up. No separate switch; it feeds discovery once usage data arrives |
Velory reserves names for other sources internally, and you may see them referenced elsewhere. Only the two above produce data at the moment.
Turn it on
- Go to Settings → Integrations → Google Workspace.
- Open the Discovery syncs tab.
- Switch on SaaS Discovery — described as "Detect third-party apps via SSO logs and OAuth grants."
- Click Sync discovery to run the first collection.
The Sync discovery button is disabled while the toggle is off. Turn the toggle on first.
The first run is the heavy one. It pulls a full history, so it takes a few minutes; discovered services appear on the SaaS Discovery page as they are found rather than all at once at the end. You do not need to keep the page open.
After the first run
Velory then syncs once a day, at 06:00 UTC. The daily run is incremental and deliberately overlaps the previous couple of days, which covers the lag between something happening in Google Workspace and the Reports API making it available. You should not need to run a manual sync again unless you want fresh data immediately.
Reading the run history
The Discovery syncs tab lists recent runs:
| Column | Meaning |
|---|---|
| When | When the run started |
| Status | Running, Completed or Failed |
| Apps | Services discovered in that run |
| Matched | How many were matched to a service in your catalogue |
| Users | Detected user accounts |
A completed run summarises itself above the table: how many services were discovered and how many matched your catalogue.
Good to know
Nothing appeared after the first sync. Is it broken?
Give it a few minutes and reload the SaaS Discovery page — results stream in during the run rather than landing at the end.
If a run finished and the inbox is still empty, the likely explanation is that there was nothing to find: discovery only sees services reached through Google Workspace single sign-on or granted OAuth access to your Google data. Tools your team signs in to with separate local accounts leave no trace in this source.
The last sync failed. What do I do?
Run it again. Failures are usually transient. If it keeps failing, check the Google Workspace connection itself — an expired or revoked authorisation stops discovery along with everything else on that integration.
What data does Velory read?
Sign-in events and OAuth grant records, including which permissions each service was granted, and the account identifiers attached to them. Discovery reads access records — not the contents of documents, mail or messages inside those services.
Can I turn it off again?
Yes. Switch SaaS Discovery off on the same tab. Collection stops and the daily run skips your company. Services already discovered stay on the page with their status and history intact.
Does turning it on change anything in Software?
No. Enabling discovery starts observation only. Services appear as New and wait for a decision from you — see How do I manage, monitor, ignore or retire a discovered service?.
Was this article helpful?