Customer PlaybooksGoogle Workspace — Signature Deployment Setup

Google Workspace Signature Deployment Setup

Google Workspace signature deployment — push AdtoSign-managed email signatures into every Gmail mailbox, centrally managed

How to push your AdtoSign-managed email signatures into your Google Workspace users' mailboxes. AdtoSign offers two deployment modes — pick the one that matches your security posture. Both deliver the same rendered signature.

Status: Rolling out in phases — contact AdtoSign support to enable it for your organization. This guide documents the setup and limitations of each mode.

Audience: Google Workspace Super Admin. Your employees must already be synced into AdtoSign (Directory) and assigned a master signature (Signatures → master signature → assign users).

Which mode should I choose?

Option A — AdtoSign-hostedOption B — You run a script
Who pushes the signatureAdtoSign's serversA script inside your Workspace
Credential AdtoSign holdsA Google service account with domain-wide delegationNone
Where the schedule runsAdtoSign (managed job runner)Google (Apps Script trigger)
Central status/logging in AdtoSign✅ Full per-user status⚠️ Limited (logs live in your Apps Script console)
Admin effortOne-time delegation grantInstall + keep the script
Best forTeams that accept AdtoSign holding a delegated keySecurity-conscious teams that will not grant a domain-wide key

Set your choice in AdtoSign → Signatures → Deployment → Google Workspace mode.

Both modes:

  • Write to the user's Gmail signature (the sendAs "managed signature" slot named "AdtoSign - Managed Signature").
  • Use hosted image URLs (small HTML), so banner swaps propagate with no re-push.
  • Re-sync on a schedule to repair signatures a user manually edited (drift re-sync).

Option A — AdtoSign-hosted (service account + domain-wide delegation)

AdtoSign impersonates each user through a Google service account and sets their signature for them. You grant that access once in the Google Admin Console.

Setup

  1. In AdtoSign, open Signatures → Deployment → Google Workspace and choose AdtoSign-hosted. Copy the OAuth client ID and scopes shown.
  2. In the Google Admin Console go to Security → Access and data control → API controls → Domain-wide delegation.
  3. Click Add new, paste AdtoSign's client ID, and paste these scopes:
    • https://www.googleapis.com/auth/gmail.settings.basic
    • https://www.googleapis.com/auth/gmail.settings.sharing
  4. Click Authorize.
  5. Back in AdtoSign, click Deploy (or wait for the next scheduled run).

How it runs

  • AdtoSign fans out per user with automatic retries, and re-syncs nightly to repair drift. Per-user success/failure appears in Deployment → Logs.

Trade-off

  • ✅ Full central control and per-user logging.
  • ⚠️ AdtoSign holds a domain-wide-delegated key for your tenant. Revoke anytime by deleting the delegation entry in step 3.

Option B — You run an Apps Script (no AdtoSign key)

A Google Apps Script — provided by AdtoSign — runs inside your own Workspace on a schedule you control. It reads your user list, fetches each rendered signature from AdtoSign, and sets it. AdtoSign never holds a key to your tenant.

Setup

  1. In AdtoSign, open Signatures → Deployment → Google Workspace, choose Apps Script, and copy your organization token.
  2. Create the Apps Script project from the AdtoSign template (or install the published script — see the link in the AdtoSign UI).
  3. In Project Settings → Script properties, paste your organization token as ADTOSIGN_ORG_TOKEN.
  4. Run the script once and authorize the requested access:
    • Admin SDK Directory (read your user list)
    • Gmail settings (gmail.settings.sharing — set each user's signature)
  5. Add a time-based trigger (Triggers → Add trigger → time-driven → e.g. daily). This is your drift re-sync — Google runs it, not AdtoSign.

Trade-off

  • ✅ No domain-wide key leaves your tenant; the script stays in your trust boundary.
  • ✅ Google hosts the schedule (no AdtoSign job runner involved).
  • ⚠️ You install and maintain the script; run logs live in your Apps Script console (Executions), not the AdtoSign dashboard.
  • ⚠️ Subject to Google Apps Script daily quotas for very large domains.

Limitations (BOTH options)

  • Replies/forwards: whether the signature appears on replies/forwards is a per-user Gmail setting the API cannot write. Google's "Signature defaults" section (Settings → See all settings → General → Signature) has an "On reply/forward use" dropdown that defaults to No signature — and neither the Gmail API, Admin SDK, Apps Script, nor GAM can change it (the deploy only writes the signature content, which Google auto-selects for new emails only). Each user must set it once, by hand: Settings → Signature → "On reply/forward use" → select the signature, and optionally tick "Insert signature before quoted text in replies" — otherwise the signature lands at the very bottom, below the quoted thread. Orgs that need guaranteed reply signatures with correct placement should use the mail-flow gateway, which inserts signatures server-side on every send.
  • Mobile native app: the Gmail app on iOS/Android keeps its own plain-text mobile signature and does not reliably apply the rich sendAs signature to mail composed in the app. Gmail mobile web works. This is a Google limitation.
  • Not tamper-proof: a Gmail signature is user-editable — a user can change or delete it. The drift re-sync restores it on the next run, but between runs it can differ. (For guaranteed signing use the Outlook add-in / transport-rule path on Microsoft 365.)
  • Size: Gmail caps the signature (~10KB), so signatures use hosted image URLs, not embedded images.
  • Overwrite: deployment replaces the managed signature slot. Users' unrelated personal signatures are left alone.
Was this page helpful?