> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/documentation/management-console/integrations/google-workspace.md). # Google Workspace GuardWare can scan and monitor Gmail and Google Drive for sensitive data using a Google Cloud service account. A service account is a non-human Google account that represents an application rather than an individual user. The service account uses domain-wide delegation to access Google Workspace data on behalf of users in the organisation. The Google Workspace super admin authorises the service account and specifies the OAuth scopes that GuardWare can use when accessing Google Workspace data. This page explains how to create the Google Cloud service account, configure the required APIs and permissions, create a Security Group in Google Workspace Admin Console, authorise domain-wide delegation, and connect Google Workspace to GuardWare. ## Prerequisites Before connecting Google Workspace to GuardWare, ensure the following are in place: * A Google Cloud project with billing enabled * A Google Workspace super admin account * A Google Workspace admin account ## Set Up a Google Cloud Service Account {% stepper %} {% step %} ### Create a Google Cloud Project 1. Go to [**Google Cloud Console**](https://console.cloud.google.com) and sign in with an account that has sufficient Google Cloud permissions to create and manage a project. 2. Click the project dropdown at the top of the page and click **New Project**.
3. Enter a project name and click **Create**.
4. After creating the project, select it from the project selection dropdown or click **Select Project** in the **Notifications** panel.
{% endstep %} {% step %} ### Enable Required APIs Enable the Google APIs required for the GuardWare integration. These APIs provide the interfaces GuardWare uses to authenticate and interact with Google Workspace services. 1. In the [**Google Cloud Console**](https://console.cloud.google.com), click the :bars: **menu** icon and go to **APIs & Services > Library**. 2. Search for the following APIs:
APIFunction
Admin SDK APIUsed to retrieve Google Workspace directory information, including users, groups, and organisational units.
Gmail APIUsed to access Gmail messages and attachments for scanning.
Google Drive APIUsed to access files and folders stored in Google Drive for scanning, including supported shared-drive content.
3. Click **Enable** to start all the API services in their respective pages.
4. Go to **APIs & Services > Enabled APIs & Services** and confirm that all three APIs are enabled. {% endstep %} {% step %} ### Create a Service Account The service account acts as the identity GuardWare uses to access Google's APIs. The roles assigned here allow it to read organisation-level information during a scan. 1. Click the :bars: menu and go to **IAM & Admin** > **Service Accounts**.
2. Click **Create Service Account**.
3. Enter a name and description for the service account and click **Create and Continue**.
4. In the **Permissions (optional)** tab, click on the dropdown and assign the following roles to the service account. Click **+Add another role** each time to add additional roles.
1. Organisation Administrator 2. Organisation Policy Viewer 3. Owner 5. Click **Continue**, leave the **Principals with access (optional)** field as is, then click **Done**.
6. On the **Service Accounts** page, click the service account you created.
7. Search for the **Unique ID** shown in the details and store it in a secure location in your device. The Unique ID will be needed in the [**Authorise the service account in Google Workspace**](#authorise-the-service-account-in-google-workspace) section.
{% endstep %} {% step %} ### Generate a JSON key The JSON key is the credential file GuardWare uses to authenticate as the service account. It contains a private key that signs API requests, so it **must be kept secure and not shared with anyone**. 1. In **IAM & Admin > Service Accounts**, click the service account you created. 2. Click the **Keys** tab. 3. Click **Add Key** and select **Create new key** from the dropdown.
4. Select **JSON**, click **Create,** and click **Close**.
{% hint style="info" %} The key file downloads automatically. Store the JSON key securely as you will need to upload it when configuring Google Workspace in GuardWare. {% endhint %} {% endstep %} {% endstepper %} ## Configure Google Workspace After completing the Google Cloud configuration, switch to [**Google Workspace Admin Console**](https://admin.google.com) to configure the Google Workspace components required by GuardWare. {% stepper %} {% step %} ### Create a Security Group GuardWare uses a Google Workspace Security Group to define the users included in the Google Workspace integration. 1. Navigate to **Directory > Groups** in the admin console.
2. Click **Create group** and enter the following details: 1. **Group Name** — Enter a name for the Security Group. 2. **Group email** — Enter the email address for the group. 3. **Description** — Enter a description that identifies the purpose of the group. 3. Add the group owner(s) and tick the **Security** box to add a label to the group.
4. Configure the group access settings as required by your organisation.
5. Click **Create group**. {% endstep %} {% step %} ### Add Users to the Security Group Add the users whose Gmail and Google Drive data should be included in the GuardWare integration. 1. In the **Google Workspace Admin Console**, go to **Directory > Groups**. 2. Select the Security Group you created and click **Add members**.
3. Enter the email addresses of the users to add to the group. 4. Select the users and click **Add to group**. #### Verify Security Group Membership 1. Go to **Directory > Groups** and open the Security Group. 2. View the group members. 3. Confirm that all users whose data should be included in the GuardWare integration are listed. {% endstep %} {% step %} ### Authorise the service account in Google Workspace Domain-wide delegation grants the service account permission to impersonate users across the organisation. **A super admin must complete this step in the Google Workspace Admin Console.** 1. Go to [**Google Workspace Admin Console**](https://admin.google.com) with **a super admin account** and navigate to **Security** > **Access and data control** > **API controls**.
2. Click **Manage Domain Wide Delegation**.
3. Click **Add new**.
4. Enter the service account's **Unique ID** in the **Client ID** field. 5. Enter the required OAuth scopes for Gmail and Google Drive as comma-separated values: 1. `https://www.googleapis.com/auth/admin.directory.user.readonly` 2. `https://www.googleapis.com/auth/admin.directory.group.readonly` 3. `https://www.googleapis.com/auth/admin.directory.group.member` 4. `https://www.googleapis.com/auth/admin.directory.group.member.readonly` 5. `https://www.googleapis.com/auth/admin.directory.orgunit.readonly` 6. `https://www.googleapis.com/auth/admin.reports.audit.readonly` 7. `https://www.googleapis.com/auth/drive` 8. `https://www.googleapis.com/auth/gmail.readonly` 9. `https://www.googleapis.com/auth/gmail.modify` 10. `https://mail.google.com/` 6. Click **Authorise**. Changes to domain-wide delegation can take time to propagate across the organisation. If GuardWare cannot authenticate immediately after saving, wait and retry. {% endstep %} {% endstepper %} ## Connect Google Workspace to GuardWare After setting up the Google Cloud Service Account, configure the following details in GuardWare Management Console: 1. Navigate to **ORGANISATION** > **Google Workspace.** 2. In **Admin Email,** enter the Google Workspace admin email address that was used to create the JSON Key. 3. Enter the **Security Group** email address. 4. Enable **Gmail Monitoring** for Gmail and **Google Drive Monitoring** for Google Drive**.** 5. Upload the [**Google Service Account JSON**](#generate-a-json-key) credentials you generated while setting up the Google Cloud Service Account. 6. Click **Submit**.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.guardware.com/documentation/management-console/integrations/google-workspace.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.