> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/integrations-google-drive/create-google-admin-user.md).

# Create Google admin user

Please ensure that the admin user's organizational unit has Drive enabled.

You need to create either a **super** admin user **or** a **custom** admin user, depending on the [use cases](/docontrol-user-guide/integrations/integrations-google-drive/select-use-cases.md) you selected to implement in your organization:

* **Shadow apps** - Create or connect to a [super admin user](#create-super-admin-user). This super admin user is also valid for integrating with the Google Drive and SPM misconfiguration capabilities.
* **Google Workspace** **monitoring and remediation** - Create or connect to a [custom admin user](#create-custom-admin-user). This user is not sufficient to integrate with the Shadow App module.
* **SPM misconfigurations** - Create or connect to a [custom admin user](#create-custom-admin-user). This user is not sufficient to integrate with the Shadow App module.

{% hint style="warning" %}

* This step is a prerequisite for [setting up a service account](/docontrol-user-guide/integrations/integrations-google-drive/set-up-service-account.md). You need to link a service account with a Google admin user. 
* Create only **one** Google admin user: a super admin or custom admin.
* As an admin user, you must log into Google Workspace at least once before integrating with DoControl. 
  {% endhint %}

## Create super admin user

To leverage DoControl's Shadow App module in Google Workspace, you need to create or connect a **super admin** user. This user will be linked to your service account.

{% hint style="info" %}

* We recommend creating a **new** super admin user dedicated to DoControl, since then there is no issue if an existing super admin user leaves the company.
* The super admin user you create for the Shadow Apps module is also valid for integrating with the Google Drive and SPM misconfiguration capabilities.
* There is **no** need to create a custom admin user.
  {% endhint %}

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FzlFQcVPCWXOiJ7hOxhPD%2FGoogle%20Wizard%20super%20admin.png?alt=media&amp;token=c3fed6bc-2d58-44d3-9473-096e44654973" alt=""><figcaption></figcaption></figure>

#### To create a super admin user:

1. In [Google Admin Console](https://admin.google.com/u/2/ac/users), set up a super admin account. Make sure you assign the super admin role to the admin user.
2. Log into Google Workspace at least once as the super admin user you created.&#x20;
3. In the DoControl integration wizard, enter the super admin's email to use with your service account.
4. Click **Next**.&#x20;
5. Continue to the next step: [Set up a service account](/docontrol-user-guide/integrations/integrations-google-drive/set-up-service-account.md). &#x20;

<details>

<summary><strong>Q:</strong> <strong>Why do I need a super admin user for DoControl's Shadow App module?</strong> </summary>

**A:** A regular admin user is insufficient for the Shadow App module to operate. To leverage its full capabilities, a super admin user must perform the integration.&#x20;

* With admin user permissions, DoControl is unable to track activities of other admin users, since token installations (either as end users or org-wide) are not detected by other admins.
* With admin user permissions, DoControl can track activities only for the specific admin's Google Workspace organizational unit.
* With admin user permissions, DoControl can't retrieve shadow app Google Workspace events. These are essential for usage and risk scoring calculations, API call tracking, IP call tracking and more.

</details>

## Create custom admin user

To leverage DoControl's capabilities in Google Drive and SPM misconfigurations, you need to create or connect a custom admin user. This ensures that the admin user performing the integration has the necessary privileges to integrate DoControl with Google Drive.  This user will be linked to your service account.

{% hint style="info" %}

* We recommend creating a **new** custom admin user dedicated to DoControl, since then there is no issue if an existing admin user leaves the company.
* If you wish to leverage the Shadow App module, you must create a **super** admin user.
* To create an administrator custom role, see [Google Workspace documentation](https://knowledge.workspace.google.com/kb/how-to-create-a-custom-role-000007847).
  {% endhint %}

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FTl4i5RoYKgekFK7NP8bt%2FGoogle%20wizard%20custom%20admin.png?alt=media&amp;token=6763be34-f728-4f55-b1f3-07580b4befaa" alt=""><figcaption></figcaption></figure>

#### To create a custom admin user:

1. In [Google Admin console](https://admin.google.com/u/2/ac/users), set up a new custom admin account.

2. Click the new custom admin account, and under **Admin roles and privileges**, click **Privileges**.<br>

   <figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FnOJR389SQvY9iRI1JmGf%2Fadmin%20roles%20and%20privileges.png?alt=media&amp;token=dfd70e6a-c8c4-4cb2-80ab-0bf4080f464e" alt=""><figcaption></figcaption></figure>

3. In **Admin console privileges**, scroll down to **Services > Drive and Docs**.

4. Select **Settings**. All these privileges are included:
   * Docs templates
   * Manage classic Google sites
   * Move any file or folder into shared drives
   * View details of new Google sites<br>

     <div align="left"><figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2F2VI26ymwpe1uKOn7Kcj0%2FCustom%20admin%20settings.png?alt=media&amp;token=be20694d-661c-4672-9e69-5f27ef8894ba" alt="" width="375"><figcaption></figcaption></figure></div>

5. In **Services**, scroll down to assign this privilege: **Data classification > Manage labels.**\
   \
   ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2Fd4cVMJPb8dXxECKLnMlb%2FGoogle%20data%20classification.png?alt=media\&token=5413821b-2eda-4efe-ac62-dc43818850c0)<br>

6. In **Admin API privileges**, assign these privileges to your custom rol&#x65;**:**
   * Admin API privileges > Reports
   * Admin API privileges > Domain management
   * Admin API privileges > Groups >  Read
   * Admin API privileges > Organization Units > Read
   * Admin API privileges > Users > Read\
     \
     ![](https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FnXTkjtp4pESo0dN3pJmH%2FAdmin%20API%20roles.png?alt=media\&token=4db8a270-9fd8-4ce6-b430-745711f4e323)

7. From [Google Admin console](https://admin.google.com/u/2/ac/users), select **Users** > **Click the user >** **Assign role** to assign the role to the custom Google admin user.

8. Log into Google Workspace at least once as the custom admin user you created.

9. In the DoControl integration wizard, enter the custom admin's email to use with your service account.

10. Continue to the next step: [Set up a service account](/docontrol-user-guide/integrations/integrations-google-drive/set-up-service-account.md). &#x20;

### Custom admin roles

When you create a custom Google admin user, you assign these roles:

<table><thead><tr><th width="211.66666666666666">Google admin role</th><th>Path</th><th>Purpose</th></tr></thead><tbody><tr><td>Drives and docs</td><td>Admin console privileges > Services > Drive and Docs > Settings</td><td>Grants DoControl access to drives and documents in Google Drive</td></tr><tr><td>Labels</td><td>Admin console privileges > Services > Data classification > Manage labels</td><td>Grants DoControl Read access to Google labels applied to documents in Google Drive</td></tr><tr><td>Domain management</td><td>Admin API privileges > Domain management</td><td>Grants DoControl access to Google Drive domains</td></tr><tr><td>Groups</td><td>Admin API privileges > Groups > Read</td><td>Grants DoControl Read access to Google Drive groups</td></tr><tr><td>Organization units</td><td>Admin API privileges > Organization unit > Read</td><td>Grants DoControl Read access to Google Drive organization units</td></tr><tr><td>Reports</td><td>Admin API privileges > Reports</td><td>Grants DoControl access to reports and audit logs, such as real-time events</td></tr><tr><td>Users</td><td>Admin API privileges > Users > Read</td><td>Grants DoControl Read access to Google Drive users</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/integrations/integrations-google-drive/create-google-admin-user.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.