Configuring Google Workspace authorizations

Refer to the Google Workspace documentation for the following steps. Google configuration steps are subject to change.

1. Follow Step 1: Create a Project.

2. Follow Step 2: Turn on the APIs for the service account. The service account will be created in Step 4.

   1. Enable Admin SDK and Gmail API from the list.

3. Under Step 3: Set up the OAuth consent screen.

   1. Choose a recognizable name such as “Email Security - Cloud Authorization” for the application name.

   2. Select a user support email from the drop-down menu. The support address must be a user in your Google Workspace organization.

   3. Add supply developer contact information. A helpdesk or IT mailbox is recommended.

4. Follow Step 4: Create the service account.

   1. For Service Account Name, choose a recognizable name such as "Email Security - Cloud Remediation Service account".

   2. For Service Account Description, a description is not required.

   3. Before closing, make note of the Client ID.

   Note

   Only the Project Creator has rights to manage this project. It is recommended that you grant at least one other person the role of Project Owner.

5. (Super-admin required) Grant the necessary scopes to the service account. The required scopes are different for SMTP mode and Native integration mode. Please review the respective lists carefully based on your deployment setup. Confirm the logged in account permissions if you do not see domain-wide delegation page.

   1. Go to the domain-wide delegation page in your Google admin console.

   2. Click Add New.

   3. Enter the Client ID created in step 4.

   4. In the OAuth scope, list the scopes matching your deployment mode as a comma separated value.

      SMTP
      https://mail.google.com
      https://www.googleapis.com/auth/admin.directory.group.readonly
      https://www.googleapis.com/auth/admin.directory.user.readonly
      https://www.googleapis.com/auth/admin.directory.group.member.readonly
      
      Native
      https://mail.google.com
      https://www.googleapis.com/auth/pubsub
      https://www.googleapis.com/auth/admin.directory.group.readonly
      https://www.googleapis.com/auth/admin.directory.user.readonly
      https://www.googleapis.com/auth/admin.directory.group.member.readonly

   5. Click Authorize.

   For Native scanning, you must enable push notifications in Google Workspace before authorizing the app in Email Security. For more information, see Gsuite push notifications.

6. If the account used to create the service account was not a super-admin then see Assign specific admin roles for assigning roles to a user, a list of users or groups as an admin.

To verify an authorization:

1. Go to the Authorization Configuration page of your authorization.

2. Under Status, select Manage.

3. For Google Workspace authorizations, enter the admin email and upload the credentials file.

   

4. Click Save. If the information provided is invalid or missing, the details will appear in the page.

   

5. Click View Details to view more details. The following pop-up will show the reasons for failed validation.

   

6. You can correct the details and save again.