Ctrlk
Contact UsVisit GuardWare
linkedinyoutube
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Google Workspace

GuardWare can scan and monitor Gmail and Google Drive for sensitive data using a Google Cloud service account. GuardWare authenticates with Google's APIs using a service account, a non-human Google account that represents an application rather than a user.

The service account is granted domain-wide delegation, which allows it to access mailboxes and Drive data across your entire Google Workspace organisation on behalf of a super admin.

This page explains how to set up the service account, generate the required credentials, and connect Google Workspace to GuardWare.

Prerequisites

Before connecting Google Workspace to GuardWare, ensure the following are in place:

  • A Google Cloud project with billing enabled

  • Google Workspace super admin account

  • Google Workspace admin account

Set Up a Google Cloud Service Account

Create a Google Cloud project

  1. Go to Google Cloud Console and sign in using an admin account.

  2. Click the project dropdown at the top of the page and click New Project.

  3. Enter a project name and click Create.

  4. After creating the project, select it from the project selection dropdown or click Select Project in the Notifications panel.

Create a Service Account

The service account acts as the identity GuardWare uses to access Google's APIs. The roles assigned here allow it to read organisation-level information during a scan.

  1. Click on the menu and go to IAM & Admin > Service Accounts.

  2. Click Create Service Account.

  3. Enter a name and description for the service account and click Create and Continue.

  4. In the Permissions (optional) tab, click on the dropdown and assign the following roles to the service account. Click +Add another role each time to add additional roles.

    1. Organisation Administrator

    2. Organisation Policy Viewer

    3. Owner

  5. Click Continue, leave the Principals with access (optional) field as is, then click Done.

  6. On the Service Accounts page, click the service account you created.

  7. Search for the Unique ID shown in the details and store it in a secure location in your device. The Unique ID will be needed in the Authorise the service account in Google Workspace section.

Generate a JSON key

The JSON key is the credential file GuardWare uses to authenticate as the service account. It contains a private key that signs API requests, so it must be kept secure and not shared with anyone.

  1. In IAM & Admin > Service Accounts, click the service account you created and click on the Keys tab.

  2. Click Add Key and select Create new key from the dropdown.

  3. Select JSON, click Create, and click Close. The key file downloads automatically.

Store the JSON key securely, as you will need to send it to the GuardWare team and use it to add target discovery in DISCOVER.

Authorise the service account in Google Workspace

Domain-wide delegation grants the service account permission to impersonate users across the organisation. This step must be completed by a super admin in Google Workspace Admin Console.

The Google Workspace super admin authorises the service account to access data across the organisation on behalf of all users.

  1. Go to Google Workspace Admin Console with a super admin account and navigate to Security > Access and data control > API controls.

  2. Click Manage Domain Wide Delegation.

  3. Click Add new.

  4. Enter the service account's Unique ID in the Client ID field.

  5. Enter the required OAuth scopes for Gmail and Google Drive as comma-separated values.

    1. https://www.googleapis.com/auth/admin.directory.user.readonly

    2. https://www.googleapis.com/auth/admin.directory.group.readonly

    3. https://www.googleapis.com/auth/admin.directory.orgunit.readonly

    4. https://www.googleapis.com/auth/admin.reports.audit.readonly

    5. https://www.googleapis.com/auth/drive

    6. https://www.googleapis.com/auth/gmail.readonly

    7. https://www.googleapis.com/auth/gmail.modify

    8. https://mail.google.com/

  6. Click Authorise.

Changes to domain-wide delegation can take time to propagate across the organisation. If GuardWare cannot authenticate immediately after saving, wait and retry.

Send details to GuardWare

After configuring everything, send the following details to the GuardWare team:

  1. JSON key

  2. Google Workspace admin email address that is used to create the JSON Key

Scan Gmail and Google Drive in DISCOVER

After you finish the setup here, complete the scan flow in DISCOVER to start scanning Gmail and Google Drive for sensitive data.

Use Target Discovery to add the Google Workspace service and let GuardWare discover the available Gmail and Google Drive targets. Then create scan jobs to scan Gmail and Google Drive for sensitive data.

PreviousMicrosoft 365

Last updated