> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/integrations/integrations-google-drive/upgrade-to-shadow-apps.md).
# Upgrade to Shadow Apps
With the [Shadow App](/docontrol-user-guide/saas-data-monitoring/shadow-apps/google-shadow-apps.md) module, you can discover all interconnected SaaS apps within your Google Workspace, and expose a full mapping and inventory of internal and 3rd party applications.
If you already integrated Google Workspace with DoControl and wish to **upgrade** to the Shadow App module, follow these steps:
* [Select use cases](#select-use-cases)
* [Create Google super admin user](#create-google-super-admin-user)
* [Define scopes ](#define-scopes)
* [Upload key file](#upload-key-file)
{% hint style="warning" %}
Shadow Apps is a premium module. If you don't have a license, this use case will be grayed out.
{% endhint %}
## Select use cases
Select the Shadow App use case:
1. From the DoControl side menu, click **Integrations**.\
\
2. Under the **Google Workspace** icon, click **Connect**.
3. After the **Google Workspace** wizard opens, click **Get started**.
4. Select the **Shadow apps** use case.
5. Click **Next** to [create a Google super admin user.](#create-google-super-admin-user)
## Create Google super admin user
To leverage DoControl's Shadow App module in Google Workspace, you need to create or connect a **super admin** user. This user will be linked to your service account.
For the super admin, make sure to use the **same** admin email as already used in your existing DoControl integration with Google Workspace.
Q. Why do I need a super admin user for DoControl's Shadow App module?
A. A regular admin user is insufficient for the Shadow App module to operate. To leverage its full capabilities, a super admin user must perform the integration.
* With admin user permissions, DoControl is unable to track activities of other admin users, since token installations (either as end users or org-wide) are not detected by other admins.
* With admin user permissions, DoControl can track activities only for the specific admin's Google Workspace organizational unit.
* With admin user permissions, DoControl can't retrieve shadow app Google Workspace events. These are essential for usage and risk scoring calculations, API call tracking, IP call tracking and more.
{% hint style="warning" %}
* If the super admin user email is **different** from your existing integrator email, you will need to run the entire integration procedure with the new admin email.
* We recommend using a super admin user **dedicated** to DoControl, since then there is no issue if an existing super admin user leaves the company.
{% endhint %}
#### To create a super admin user:
1. In [Google Admin Console](https://admin.google.com/u/2/ac/users), set up a super admin account. Make sure you assign the super admin role to the admin user.
2. Log into Google Workspace at least once as the super admin user you created.
3. In the DoControl integration wizard, enter the super admin's email to use with your service account. Make sure to use the **same** admin email as already used in your existing DoControl integration with Google Workspace.
4. Click **Next**.
5. **Skip** the next step: Set up a service account.
6. Continue to the next step: [Define scopes](#define-scopes).
## Define scopes
To assign permission scopes to your service account for accessing APIs, you need to complete these steps in the wizard:
* [Apply permissions](#apply-permissions)
* [Copy and paste snippet](#copy-and-paste-snippet)
{% hint style="info" %}
You can skip the Create new API client step.
{% endhint %}
### Apply permissions
1. In the DoControl integration wizard, go to **Apply permissions.**
2. Select the relevant **Read** or **Write** permissions, or both:
* **Read** - Monitor file sharing and metadata of Google Drive assets, and detect risky shadow apps
* **Write** - Remediate Google assets for overexposure, and delete risky shadow apps
{% hint style="success" %}
For detailed descriptions of each permission type, see [Read-only vs write permissions](/docontrol-user-guide/integrations/integrations-google-drive/define-scopes.md#read-only-vs-write-permissions).
{% endhint %}
### Copy and paste snippet
The snippet in the DoControl integration wizard contains all the relevant permissions you need for your API client, including Shadow Apps.
You need to copy the snippet from DoControl, and paste it into the **Google Admin console**.
1. In the DoControl wizard, go to **Copy and paste snippet**.
2. Click **Copy** **snippet**. The snippet contains these read and write permissions:\
\
`https://www.googleapis.com/auth/admin.reports.audit.readonly,`\
`https://www.googleapis.com/auth/admin.directory.user.readonly,`\
`https://www.googleapis.com/auth/drive.readonly,`\
`https://www.googleapis.com/auth/admin.directory.domain.readonly,`\
`https://www.googleapis.com/auth/admin.directory.group.readonly,`\
`https://www.googleapis.com/auth/admin.directory.group.member.readonly,`\
`https://www.googleapis.com/auth/drive.apps.readonly`\
`https://www.googleapis.com/auth/admin.directory.orgunit.readonly,`\
`https://www.googleapis.com/auth/drive.admin.labels.readonly,`\
`https://www.googleapis.com/auth/drive,`\
`https://www.googleapis.com/auth/admin.directory.user.security`
3. Login to the [Google Admin console](https://admin.google.com/u/1/ac/owl/domainwidedelegation?pli=1).
4. Select [Domain-wide delegation](https://admin.google.com/u/2/ac/owl/domainwidedelegation?pli=1) > **Add a new client ID.**
5. Paste the snippet into the first line of the **OAuth scopes** field. Do **not** add any extra lines in the OAuth scopes.\
\
6. Click **Authorise**.\
The Google Admin console organizes the snippet content into the relevant scopes.
7. Make sure all your scopes are displayed.
8. Continue to the next step: [Upload key file](#upload-key-file).
{% hint style="success" %}
To learn more about the different scopes, see [Read only vs write permissions](/docontrol-user-guide/integrations/integrations-google-drive/define-scopes.md#read-only-vs-write-permissions).
{% endhint %}
## Upload key file
After you've applied the relevant Read and Write permissions, you need to create a key file in Google Cloud Platform (GCP), and then upload the key file to DoControl.
{% hint style="warning" %}
Make sure you have access to Google Cloud Platform (GCP).
{% endhint %}
1. In Google Cloud Platform (GCP), navigate to **IAM and admin** > [Service accounts](https://console.cloud.google.com/projectselector2/iam-admin/serviceaccounts?supportedpurview=project\&authuser=2).
2. Select your project.
3. Click the relevant service account email.
4. From the top menu, select the **Keys** tab.
5. Click **Add key > Create new key**.
6. In the **Key type** option, select JSON.
7. Click **Create**. The JSON file is downloaded to your computer. Click **Close**.
8. Upload the JSON file here.
9. Click **Next**. You have completed the integration wizard for Google Workspace. \
It might take a while - up to 30 minutes - until DoControl is connected to your Google Workspace. In the meantime, you can leave the Integration page.
10. Once the integration succeeds, you'll get a success message:
11. Wait patiently until your data is fully synced with DoControl. This might take a while, even up to a couple of days, depending on the size of your organization. In the meantime, view your [Google posture](/docontrol-user-guide/risk-management/posture/google-workspace-posture.md) as insights come in.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.docontrol.io/docontrol-user-guide/integrations/integrations-google-drive/upgrade-to-shadow-apps.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
