Set up Pendo Data Sync to BigQuery

Use this article to connect Pendo Data Sync directly to BigQuery. You configure a destination service account and a required Cloud Storage staging bucket, then enter those details in Pendo.

Note: Data Sync to BigQuery is currently available for Pendo subscriptions in the US and EU regions only.

How authentication works

The recommended authentication method uses two service accounts:

• A Pendo service account, displayed in the destination form, assumes the destination service account using short-lived credentials.
• A destination service account in your Google Cloud project has the required access to BigQuery and the staging bucket.

Don't grant the Pendo service account direct access to BigQuery or Cloud Storage. Grant it permission to assume the destination service account, which holds the required destination permissions.

A service account key is also supported, but service account role authentication is recommended because it doesn't require sharing a long-lived JSON key with Pendo.

Prerequisites

Before you begin, make sure that you:

• Are a Pendo subscription admin or have the Configure Data Sync permission.
• Can create and manage service accounts and IAM bindings in the destination Google Cloud project.
• Can create or configure the destination BigQuery dataset and a dedicated Cloud Storage staging bucket.
• Know the Google Cloud project ID, dataset name, and intended dataset location.

The staging bucket is required. Your BigQuery dataset and staging bucket can use a supported BigQuery location, but both resources must use the same location. This is separate from the Pendo-region availability note above.

Step 1. Start the destination in Pendo

1. Open the Data Sync setup flow and select Google BigQuery.
2. Enter the Project ID and Dataset name.
3. For Auth method, select Service Account Role (recommended).
4. Copy the Pendo service account shown in the form. The value is specific to the Pendo connection; don't use an example address from documentation.

Keep the setup flow open while you configure Google Cloud.

Step 2. Create the destination service account

1. In the Google Cloud project that owns the destination, create a dedicated service account for Pendo Data Sync.
2. If the BigQuery dataset doesn't exist, grant the destination service account the BigQuery User role at the project level. This allows the connector to create the dataset, run jobs, and read project metadata.
3. If the dataset already exists, grant:
   • bigquery.jobs.create at the project level.
   • BigQuery Data Owner on the destination dataset, or a custom dataset-level role containing:
     • bigquery.datasets.get
     • bigquery.tables.create
     • bigquery.tables.delete
     • bigquery.tables.get
     • bigquery.tables.getData
     • bigquery.tables.list
     • bigquery.tables.update
     • bigquery.tables.updateData
     • bigquery.routines.get
     • bigquery.routines.list

Step 3. Allow Pendo to use the destination service account

On the destination service account, grant the Pendo service account copied from the form both of the following roles:

• Service Account Token Creator
• Service Account User

Scope these bindings to the dedicated destination service account where possible.

If your Google Cloud organization uses domain-restricted sharing and blocks the Pendo service account, contact Pendo Support for the customer ID required by your policy.

Step 4. Create the staging bucket

1. Create a dedicated Cloud Storage bucket for Data Sync staging.
2. Use the same location as the BigQuery dataset. If the dataset doesn't exist, Pendo creates it in the bucket's location.
3. Keep the bucket private. We recommend uniform bucket-level access.
4. Grant the destination service account Storage Admin on the bucket. For narrower access, use either:
   • Storage Legacy Bucket Reader and Storage Object User on the bucket; or
   • A custom bucket-level role containing:
     • storage.buckets.get
     • storage.objects.list
     • storage.objects.get
     • storage.objects.create
     • storage.objects.delete

Pendo deletes staged objects after they are loaded. You can add a two-day object lifecycle rule as an additional safeguard.

Step 5. Complete the destination in Pendo

1. Return to the BigQuery destination form.
2. Enter the Service account email for the destination service account.
3. Enter the GCS bucket name and GCS bucket region.
4. Validate the connection, then continue to select data.

If you use a key instead of role authentication:

1. In Google Cloud, go to IAM & Admin > Service Accounts and open the destination service account.
2. Open Keys, then select Add key > Create new key.
3. Select JSON, create the key, and store the downloaded file securely. You can't download the same key again.
4. In Pendo, select Service Account Key and provide the JSON key for the destination service account.
5. Protect, rotate, and revoke the key according to your organization's credential policy.

For more information, see Create and delete service account keys.

Step 6. Select data to sync

Choose the Pendo applications to sync. You can also choose account and visitor metadata. Data selection is optional during initial setup and can be completed later.

The first recurring sync begins overnight after the destination is configured and data is selected. Subsequent syncs run approximately every 24 hours.

For the available tables and fields, see Data Sync schema definitions and the BigQuery ERD.

Troubleshooting