> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/integrations-google-drive.md).

# Google Workspace

Google Workspace is a collection of cloud productivity and collaboration tools and applications, such as Google Calendar, Google Sheets, Google Chat, Google Docs, and Google Drive. All these tools run on your organization's SaaS platform.

Google Workspace has revolutionized the way organizations do business, resulting in increased collaboration, productivity and efficiency. With three billion users and massive volumes of sensitive data, Google Workspace is prone to security risks, data overexposure, and malware attacks. 

## Use cases

Integrate Google Workspace with DoControl to govern your Google Workspace security and boost your monitoring and remediation capabilities:

* **Discover your data exposure** - View all assets, users, shared drives, personal drives (My Drive), permissions, and shadow apps in a single view
* **Discover SaaS identities** - Discover and monitor your risky internal users to protect your organization from identity threats
* **Get real-time alerts** - Trigger alerts based on file overexposure and get real-time event notifications for anomalous activity, such as, external or public sharing of sensitive files, 4th party sharing, sharing sensitive files with private and personal emails, extensive file downloads, former employees downloading or sharing assets, sharing assets with or by a malicious domain
* **Remediate past exposure using on-demand bulk remediation** - Use [remediation actions ](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-drive-remediation.md)to change owner, remove external collaborators, remove org-wide and public sharing, remove permissions, remove external collaborators
* **Remediate future data exposure via automated workflows** - Prevent external sharing, remove external collaborators, prevent external and public PII sharing, prevent sharing sensitive content externally (regex), remove sharing links, remove web publishing, prevent sharing with private and personal email accounts, revoke 4th party sharing, remove cross-team collaboration, change asset owner, delete file, prevent malware propagation, notify on downloading and uploading files, notify on ransomware and encryption key uploads, etc
* **Detect sensitive data** - Utilize cloud-native NLP to scan sensitive data types in your Google Drive, and delete if necessary.
* **Leverage Google labels** - Mitigate overexposure based on Google labels that are applied to Google Drive files, and add existing labels to Google Drive assets. To set up Google Workspace DLP to support labels, see [Google Workspace Admin Help](https://support.google.com/a/answer/9646351?hl=en). 
* **Manage SPM misconfigurations** - See how your Google Workspace security settings measure up to compliance standards, avoid security vulnerabilities, and remediate if necessary.
* **Leverage global search** - Navigate your data maze to quickly pinpoint the riskiest use cases and SaaS security threats in your organization.
* **Shadow apps** - With DoControl's premium [Shadow App](/docontrol-user-guide/saas-data-monitoring/shadow-apps.md) module, you can discover all shadow apps installed across your organization's Google Workspace, and remove risky 3rd party apps or user tokens.
* **Prevention of malware infiltration** - DoControl customers who are using [CrowdStrike Falcon](/docontrol-user-guide/integrations/integrations-crowdstrike.md) to stop breaches can prevent malware from spreading in Google Drive. DoControl deletes malware immediately once detected.

{% hint style="warning" %}

* DoControl does not support multiple Google Workspaces. We recommend you integrate the most relevant workspace, based on the users and assets you wish to protect.
* If you wish, you can monitor [one organizational unit only](/docontrol-user-guide/integrations/integrations-google-drive/define-scopes.md#select-one-organizational-unit-optional) or up to [5 Google groups](https://docs.docontrol.io/docontrol-user-guide/integrations/integrations-google-drive/define-scopes#monitor-google-groups) instead of your entire Google Workspace.
  {% endhint %}

## Prerequisites

Make sure you have the required prerequisites before integrating Google Workspace with DoControl:

* Required business plan: [Business Standard](https://workspace.google.com/pricing.html) and above. 
* Depending on the capability you are integrating, the integrator must have one of these roles:
  * Custom admin (Google Drive integration) OR
  * Super admin (Shadow Apps)<br>
* Before starting to integrate, you need to:
  * Sign up to DoControl. Follow the onboarding steps in [Create first account](/docontrol-user-guide/getting-started/quick-start/set-up-docontrol-basics.md#create-first-account).
  * Log into Google Workspace at least once as an [admin user.](/docontrol-user-guide/integrations/integrations-google-drive/create-google-admin-user.md#google-drive-admin)
* Verify that the person performing the integration has access to Google Cloud Platform (GCP) and Google Admin console.

{% hint style="info" %}
Learn more about [Google Workspace Administrator privileges](https://support.google.com/a/answer/1219251?hl=en-GB).
{% endhint %}

## Permission scopes

You require these permission scopes for DoControl to operate on Google Drive:

<table><thead><tr><th width="268.6271683572114">Resource use cases</th><th width="211.1036146262352">Feature within the product</th><th>Required scopes</th></tr></thead><tbody><tr><td>Listen to Google Drive activity</td><td>Events</td><td><a href="https://www.googleapis.com/auth/admin.reports.audit.readonly">https://www.googleapis.com/auth/admin.reports.audit.readonly</a></td></tr><tr><td>Access files, folders and their associated permissions</td><td>Assets on <strong>Shared Drive</strong></td><td><a href="https://www.googleapis.com/auth/admin.reports.audit.readonly">https://www.googleapis.com/auth/admin.reports.audit.readonly</a><br><a href="https://www.googleapis.com/auth/drive"><br>https://www.googleapis.com/auth/drive</a></td></tr><tr><td>Access files, folders and their associated permissions</td><td>Assets on <strong>My Drive</strong></td><td><p><a href="https://www.googleapis.com/auth/admin.reports.audit.readonly">https://www.googleapis.com/auth/admin.reports.audit.readonly</a></p><p><a href="https://www.googleapis.com/auth/drive">https://www.googleapis.com/auth/drive</a></p></td></tr><tr><td>List organization’s shared drives</td><td>Drives</td><td><a href="https://www.googleapis.com/auth/drive">https://www.googleapis.com/auth/drive</a></td></tr><tr><td>List organization’s users</td><td>Users</td><td><a href="https://www.googleapis.com/auth/admin.directory.user.readonly">https://www.googleapis.com/auth/admin.directory.user.readonly</a></td></tr><tr><td> List organization’s domains</td><td>Domains</td><td><a href="https://www.googleapis.com/auth/admin.directory.domain.readonly">https://www.googleapis.com/auth/admin.directory.domain.readonly</a></td></tr><tr><td>List organization’s groups</td><td>Groups</td><td><a href="https://www.googleapis.com/auth/admin.directory.group.readonly">https://www.googleapis.com/auth/admin.directory.group.readonly</a></td></tr><tr><td>List organization’s group members</td><td>Group members</td><td><a href="https://www.googleapis.com/auth/admin.directory.group.member.readonly">https://www.googleapis.com/auth/admin.directory.group.member.readonly</a></td></tr><tr><td>List 3rd party apps with access to your organization’s assets</td><td>Apps (identify desktop clients)</td><td><a href="https://www.googleapis.com/auth/drive.apps.readonly">https://www.googleapis.com/auth/drive.apps.readonly</a></td></tr></tbody></table>

## Integrate with Google Workspace

To integrate Google Workspace with DoControl or upgrade to the Shadow App module, follow the integration wizard to perform these steps:

1. [Select use cases](/docontrol-user-guide/integrations/integrations-google-drive/select-use-cases.md)
2. [Create a Google admin user](/docontrol-user-guide/integrations/integrations-google-drive/create-google-admin-user.md)
3. [Set up a service account](/docontrol-user-guide/integrations/integrations-google-drive/set-up-service-account.md)
4. [Define scopes](/docontrol-user-guide/integrations/integrations-google-drive/define-scopes.md)
5. [Upload a key file](/docontrol-user-guide/integrations/integrations-google-drive/upload-key-file.md)
6. [Monitor data collection](/docontrol-user-guide/integrations/integrations-google-drive/monitor-data-collection.md)

{% hint style="success" %}

* If you're an existing customer and want to leverage Google Drive labels in workflows, you need to add the updated scope snippet when you [re-integrate DoControl with Google Workspace](/docontrol-user-guide/integrations/integrations-google-drive/define-scopes.md).
* If you're an existing customer and wish to upgrade to the Shadow App module, follow the [re-integration steps](/docontrol-user-guide/integrations/integrations-google-drive/upgrade-to-shadow-apps.md).
* If you wish, you can monitor [one organizational unit only](/docontrol-user-guide/integrations/integrations-google-drive/define-scopes.md#select-one-organizational-unit-optional) or up to [5 Google groups](https://docs.docontrol.io/docontrol-user-guide/integrations/integrations-google-drive/define-scopes#monitor-google-groups) instead of your entire Google Workspace.
  {% endhint %}

The integration between Google Workspace and DoControl is done via a [service account](https://cloud.google.com/iam/docs/understanding-service-accounts#background) on the Google Cloud Platform (GCP). Once authorized, DoControl assumes the privileges and scopes assigned to the service account and can call Google APIs.&#x20;

{% hint style="info" %}
A service account is a Google account representing a non-human user who needs to be authenticated and can then get access data in Google APIs. The service account is set up on the GCP and has access to the Google Workspace. It cannot perform any actions and cannot be granted access to scopes that the user does not have access to.&#x20;
{% endhint %}

## Integration tutorial

If you prefer instructions in video format, follow our easy-to-understand tutorial for integrating DoControl with Google Workspace:

{% embed url="<https://www.loom.com/share/eda1727b01944ffaa9897e9d46b8b5cd>" %}

## Troubleshooting

Q. What happens if my Google Workspace token expires?

A. In the case that the user is no longer in the organization, or this specific service account or user was removed:

If the person who performed the integration leaves your organization, your Google Workspace token will expire. You need to reconnect to DoControl by performing the [integration procedure](/docontrol-user-guide/integrations/integrations-google-drive/select-use-cases.md) again.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/integrations/integrations-google-drive.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.