Required Permissions

The cloud state for Google Drive used by Email Security is composed of the following entities:

• Users

• Groups and Memberships

• Tokens

• Apps

• Files and Folders

• Permissions

Once the cloud state is saved, Email Security starts monitoring the changes for each user. To track changes for each user in the cloud, Email Security uses the following channels:

• Subscribe each user to Google Push Notifications for changes (https://developers.google.com/drive/v3/web/push).

• Fallback to polling each user every minute if push notifications fails (https://developers.google.com/drive/v3/web/manage-changes)

• Subscribe each user to Google Reports API to get its activities related to permissions, authorization to external apps, and tokens. ( https://developers.google.com/admin-sdk/reports/v1/get-start/getting-started)

Email Security uses the following resources for Google Drive from the APIs:

• Files and Folders metadata (not include file contents)

• Users and Groups metadata

• Permissions

• Changes (not including the content of files changed)

• Channels

• Tokens

• Applications