Google Workspace

Create a Google Cloud Project

1. Go to Google Cloud Console and sign in with an account that has sufficient Google Cloud permissions to create and manage a project.
2. Click the project dropdown at the top of the page and click New Project.

   
3. Enter a project name and click Create.

   
4. After creating the project, select it from the project selection dropdown or click Select Project in the Notifications panel.

   

Enable Required APIs

1. In the Google Cloud Console, click the menu icon and go to APIs & Services > Library.
2. Search for the following APIs:

   API

   Function

   Admin SDK API

   Used to retrieve Google Workspace directory information, including users, groups, and organisational units.

   Gmail API

   Used to access Gmail messages and attachments for scanning.

   Google Drive API

   Used to access files and folders stored in Google Drive for scanning, including supported shared-drive content.

   
3. Click Enable to start all the API services in their respective pages.

   
4. Go to APIs & Services > Enabled APIs & Services and confirm that all three APIs are enabled.

Create a Service Account

1. Click the menu and go to IAM & Admin > Service Accounts.

   
2. Click Create Service Account.

   
3. Enter a name and description for the service account and click Create and Continue.

   
4. In the Permissions (optional) tab, click on the dropdown and assign the following roles to the service account. Click +Add another role each time to add additional roles.

   

   1. Organisation Administrator
   2. Organisation Policy Viewer
   3. Owner
5. Click Continue, leave the Principals with access (optional) field as is, then click Done.

   
6. On the Service Accounts page, click the service account you created.

   
7. Search for the Unique ID shown in the details and store it in a secure location in your device. The Unique ID will be needed in the Authorise the service account in Google Workspace section.

   

Generate a JSON key

1. In IAM & Admin > Service Accounts, click the service account you created.
2. Click the Keys tab.
3. Click Add Key and select Create new key from the dropdown.

   
4. Select JSON, click Create, and click Close.

   

Create a Security Group

1. Navigate to Directory > Groups in the admin console.

   
2. Click Create group and enter the following details:

   1. Group Name — Enter a name for the Security Group.
   2. Group email — Enter the email address for the group.
   3. Description — Enter a description that identifies the purpose of the group.
3. Add the group owner(s) and tick the Security box to add a label to the group.

   
4. Configure the group access settings as required by your organisation.

   
5. Click Create group.

Add Users to the Security Group

1. In the Google Workspace Admin Console, go to Directory > Groups.
2. Select the Security Group you created and click Add members.

   
3. Enter the email addresses of the users to add to the group.
4. Select the users and click Add to group.

Verify Security Group Membership

1. Go to Directory > Groups and open the Security Group.
2. View the group members.
3. Confirm that all users whose data should be included in the GuardWare integration are listed.

Authorise the service account in Google Workspace

1. Go to Google Workspace Admin Console with a super admin account and navigate to Security > Access and data control > API controls.

   
2. Click Manage Domain Wide Delegation.

   
3. Click Add new.

   
4. Enter the service account's Unique ID in the Client ID field.
5. Enter the required OAuth scopes for Gmail and Google Drive as comma-separated values:

   1. https://www.googleapis.com/auth/admin.directory.user.readonly
   2. https://www.googleapis.com/auth/admin.directory.group.readonly
   3. https://www.googleapis.com/auth/admin.directory.group.member
   4. https://www.googleapis.com/auth/admin.directory.group.member.readonly
   5. https://www.googleapis.com/auth/admin.directory.orgunit.readonly
   6. https://www.googleapis.com/auth/admin.reports.audit.readonly
   7. https://www.googleapis.com/auth/drive
   8. https://www.googleapis.com/auth/gmail.readonly
   9. https://www.googleapis.com/auth/gmail.modify
   10. https://mail.google.com/
6. Click Authorise.