Activating Google Workspace (Gmail and Google Drive)

Prerequisites

To activate Google Workspace, you must have these:

You have the Administrator access to activate Google Workspace.
Additional Google Workspace license to integrate with Avanan. (Integration is not supported for clients on the free G-Suite license tiers.)
You have the minimum supported SaaS license. See Minimum License Requirements to Activate SaaS Applications.
If you use GCDS (Google Cloud Directory Sync) to synchronize your user groups on-premises and in the cloud, before activating Google Workspace, you must create exclusion rules for these user groups.
- avanan_inline_policy
- avanan_inline_outgoing_policy
- avanan_monitor_policy
- avanan_monitor_outgoing_policy
For more information, see User Groups.

By default, the Google Chrome browser authenticates the signed-in Chrome user in Google Workspace instead of a selected account. To see if you are signed in to Google Chrome, look for the user name in the browser's top-right corner.

Possible workarounds:

Perform the Google Workspace activation using a non-Chrome browser.
Sign out (switch to Guest) any logged-in Chrome user before you continue.

While onboarding Google Workspace (Gmail / Google Drive), Avanan creates a service user (cloud-sec-av@[domain]) in the root organizational unit.

Before onboarding, make sure that these settings are selected in your Google Admin Console.

Go to Authentication Settings of the root organizational unit and check these settings.
- The Allow users to turn on 2-Step Verification check-box is selected.
- If the Only security key option is selected, do not select the Don't allow users to generate security codes option.

Note:

If the Authentication Settings are not supported, onboarding fails. To resolve this issue, do one of these.

If you want to keep the unsupported Authentication Settings of your root organizational unit, move the service user (cloud-sec-av@[domain]) to an organizational unit with the supported Authentication Settings. Then, start onboarding Gmail or Google Drive again.
Create a new dedicated organizational unit with the supported Authentication Settings and move the service user (cloud-sec-av@[domain]) to the organizational unit. Then, start onboarding Gmail or Google Drive again.

Gmail and Google Drive - Required Permissions

Avanan requires the following permissions from Gmail and Google Drive.


Type	Permissions required	OAuth Scope	Purpose
Google Drive	View, edit, create, and delete all Google Drive files.	https://www.googleapis.com/auth/drive	Used to read files across protected drives and remediate found threats (for example, malware and DLP).
Google Drive	View your Google Drive applications.	https://www.googleapis.com/auth/drive.apps.readonly	Used during the application installation to track application entities.
Google Drive	View information about your Google Drive files.	https://www.googleapis.com/auth/drive.metadata.readonly	Used to scan files and enforce policy rules.
Google Drive	View and download all your Google Drive files.	https://www.googleapis.com/auth/drive.readonly	Used to scan the files for malware.
Gmail	Read, compose, send, and permanently delete all your Gmail emails.	https://mail.google.com/	Used to enforce policy rules and modify the email content.
Gmail	Add emails to your Gmail mailbox.	https://www.googleapis.com/auth/gmail.insert	Used for user notifications, password-protected attachments, and threat extraction by inserting emails in the user's mailbox.
Gmail	View and edit your email labels.	https://www.googleapis.com/auth/gmail.labels	Supports moving emails to Spam as part of the Threat Detection policy.
Gmail	Read, compose, and send emails from your Gmail account.	https://www.googleapis.com/auth/gmail.modify	Required for future feature enhancements.
Gmail	View your email messages and settings.	https://www.googleapis.com/auth/gmail.readonly	Used to scan email messages for threats.
Gmail	View, edit, create, or change your email settings and filters in Gmail.	https://www.googleapis.com/auth/gmail.settings.basic	Used to check mailbox settings and detect compromised accounts.
Admin Console	View your Google Chrome OS devices' metadata.	https://www.googleapis.com/auth/admin.directory.device.chromeos.readonly	Used to identify abnormalities that may indicate Business Email Compromise (BEC).
Admin Console	View your mobile devices' metadata.	https://www.googleapis.com/auth/admin.directory.device.mobile.readonly	Used to identify abnormalities that may indicate Business Email Compromise (BEC).
Admin Console	View and manage the provisioning of domains for your customers.	https://www.googleapis.com/auth/admin.directory.domain	Used to determine the protected domains associated with the Google account.
Admin Console	View and manage the provisioning of groups on your domain.	https://www.googleapis.com/auth/admin.directory.group	Used to map groups for proper policy assignment.
Admin Console	View and manage the provisioning of users on your domain.	https://www.googleapis.com/auth/admin.directory.user	Used to create the service user required for policy configuration.
Admin Console	View information about users on your domain.	https://www.googleapis.com/auth/admin.directory.user.readonly	Used to map users for proper policy assignment and to build the social graph.
Admin Console	Manage data access permissions for users on your domain.	https://www.googleapis.com/auth/admin.directory.user.security	Used during onboarding to configure Google parameters and create the service user.
Admin Console	View audit reports for your G Suite domain.	https://www.googleapis.com/auth/admin.reports.audit.readonly	Used to identify compromised accounts (BEC activity).
Admin Console	Upload messages to any Google group in your domain info.	https://www.googleapis.com/auth/apps.groups.migration	Required for future feature enhancements.
Admin Console	View usage reports for your G Suite domain.	https://www.googleapis.com/auth/admin.reports.usage.readonly	Used to: Detect compromised accounts. Detect Google Drive file changes that require rescanning.
Admin Console	View and manage the settings of a G Suite group.	https://www.googleapis.com/auth/apps.groups.settings	Used to create and maintain groups that determine how emails are handled (for example, Inline vs. Monitoring modes).
Admin Console	View and manage G Suite licenses for your domain.	https://www.googleapis.com/auth/apps.licensing	Used to determine which license should be assigned to each user.
Payments and Subscriptions	View and manage Pub/Sub topics and subscriptions.	https://www.googleapis.com/auth/pubsub	Required for future feature enhancements.
Google Account	View your primary Google Account email address	https://www.googleapis.com/auth/userinfo.email	Used to support end user authentication through Google (for example, End User Portal).
Google Account	View your personal information, including any personal information you've made publicly available.	https://www.googleapis.com/auth/userinfo.profile	Used to support end user authentication through Google (for example, End User Portal).
Google Activity API	View and add to the activity record of your Google applications.	https://www.googleapis.com/auth/activity	Required for future feature enhancements.
Google Calendar	View and edit events on all your calendars.	https://www.googleapis.com/auth/calendar.events	Used to identify and remove malicious calendar events and meeting invitations.