Begin Scanning a Google Drive App
Add your Google Drive App to Prisma SaaS to begin scanning and monitoring assets for possible security risks.
Prisma SaaS supports both My Drive and Shared Drives. Files in My Drive are individually owned whereas files in Shared Drives belong to members of a team. Groups in a team are not supported.
To connect a Google Drive app to Prisma SaaS and begin scanning assets, you need to:
- Ensure that you have a Google Drive admin account. Add that account to Prisma SaaS as super admin.
- Grant Google Drive API access to Prisma SaaS.
- Add the Google Drive app to Prisma SaaS.
For information on which automated remediation capabilities Prisma SaaS supports with Google Drive, refer to Supported Applications with Remediation.
Whether files are individually owned and shared (My Drive) or belong to members in a team (Shared Drives), Prisma SaaS scans and protects the assets because your end users can share data externally from Shared Drives just as easily as they can from My Drive.
Add Google Drive App
In order for Prisma SaaS to scan assets, you must consent to specific permissions during the course of adding the Google Drive app.
- (Recommended) Add your Google Drive domain as an internal domain.
- Verify that your Google Drive administrator account has the required privileges.Google’s default Super Admin role provides the necessary communication between Prisma SaaS and the Google Drive app.
- Read, write, and relocate assets in the app.
- API access. API access provides visibility into the assets in Google Drive and allows Prisma SaaS to monitor the sharing of assets.
- Google Drive administrator account’s domain matches the existing domain on Prisma SaaS.
- Log in to Google Marketplace using an account with Super Admin role permissions.
- Go to https://gsuite.google.com/marketplace and log out of Google Marketplace to ensure that you are not logged in as a user other than an account with Super Admin role permissions.
- Log in again to Google Marketplace using an account that has Super Admin role permissions.
- Add the email address of the Google Drive administrator to Prisma SaaS.
- Add the Google Drive app.
After authentication, Prisma SaaS adds the new Google Drive app to the Cloud Apps list asGoogle Driven, wherenis the number of Google Drive app instances that you connected to Prisma SaaS. For example, if you added one Google Drive app, the name displays asGoogle 1. You’ll specify a descriptive name soon.
- From the Prisma SaaSDashboard, selectAdd a Cloud App.
- SelectGoogle Drive.
- Enter the login credentials for the account with Super Admin role privileges on the Google page to which Prisma SaaS redirects you, thenConnect to Google Drive Account.
- Authenticate your account by entering the account password on the Google login page, if you forgot to log on to the marketplace as outlined in 3.
- ClickContinueto proceed with theDomain wide installprocess.
- Review andAcceptthe requested permissions.Prisma SaaS requires these permissions to scan your assets on Google Drive. A new browser window opens in the foreground.
- Click the app redirect link.This link informs Prisma SaaS that you installed the Google Drive app on Google Marketplace. Google no longer redirects from its marketplace.Google Drive app does not display in the Cloud Apps list if you proceed without clicking on this redirect.
- (Optional) Give a descriptive name to this app instance and specify an incident reviewer.
- Select the Google Drivenlink on the Cloud Apps list.
- Enter a descriptiveNameto differentiate this instance of Google Drive from other instances you are managing.
- Specify anIncident Reviewer Account. Use this setting with caution. The account you provide becomes a collaborator on all risks — even private files.
- (Optional) Enter theOrganizational Unitsto scan.You can enter multiple OUs including the OU name and sub-OU. For example, your domain is companydomain.com and you want to selectively scan three OUs—finance, operations, and marking/socialmedia OUs. Enter the OUs as a comma-separated list:/finance,/operations,/marketing/socialmedia. If you leave this field blank, all units are scanned.
- ClickDoneto save your changes.
- Set up a Google Remediation account.
- SelectSettings, and select the corresponding Google Drive app.
- Enter an email address for theGoogle Remediation Account. This account grants access to all assets (files and folders) in the corresponding Google Drive account.
- ClickDoneto save your changes.
- Start scanning the new Google Drive app for risks.
- Select.SettingsCloud Apps & Scan Settings
- In the Cloud Apps row that corresponds to the new Google Drive app, select.ActionsStart ScanningPrisma SaaS scans all assets in the associated Google Drive app and identifies incidents. Depending on the number of assets, it may take some time to complete the process. However, as soon as you begin to see this information populating on the Prisma SaaSDashboard, you can begin to Assess Incidents.
When you add a new cloud app, Prisma SaaS automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
- (Optional) Modify match criteria for existing policy rules.
- (Optional) Configure or edit a data pattern.
Fix Google Drive App Onboarding Issues
The most common issues related to onboarding a Google Drive app are as follows:
When you attempt to add the Google Drive app by logging in to your Google account from Prisma SaaS, you receive an authentication error.
The Google account doesn’t have sufficient permissions to authenticate and access all the assets within Google Drive.
When you attempt to add the Google Drive app by logging in to your Google account from Prisma SaaS, you receive a login error:
This email must be added as a Super Admin
The Google account doesn’t have an administrator account in Prisma SaaS.
Make sure your Google account is super admin on Prisma SaaS.
Cached files are preventing the correct redirect.
When Prisma SaaS redirects you to Google Marketplace to install the app, an
This usually occurs if you previously installed the app and deleted it from Prisma SaaS.
Delete the app from the Google Marketplace, then you’ll be able to add the Google Drive app in Prisma SaaS.
This problem occurs if you did not click the redirect link during the onboarding process.
If the Google Marketplace page is open in the same browser and session that you used when you initially added the Google Drive app, simply click on the redirect link as outlined in 5.i
Otherwise, delete the Google Drive app from the Google Marketplace and repeat the Google Drive app onboarding process in Prisma SaaS.
Fix Google Drive Monitoring Issues
If user activities for Google Drive do not display in Prisma SaaS , contact Prisma SaaS Customer Support to initiate appropriate troubleshooting steps. However, if requested do so by Prisma SaaS Customer Support due to permissions issues, remove the API client access from Google, then authenticate the Google app again to re-enable access.
- Open a web browser and log in toadmin.google.com.
- Navigate toManage API client access(located in).SecurityAdvanced Settings
- Scroll to find the list ofPrisma SaaSclients.
Google Drive App Behaviors
The most common behaviors related to Google Drive app are as follows:
When a user moves a file from Shared Drives to My Drive or vice versa, Prisma SaaS displays
Deletein the Activity log.
Google API reported the action as a
Deletewhen actually Google did in fact
Movethe file. Prisma SaaS displays in the Activity Log what Google API reports.
No known solution at this time. We communicate with our Google partner on an ongoing basis regarding its API.
Some files are shared with internal users, but Prisma SaaS indicates
This behavior is expected and by design.
Recommended For You
Recommended videos not found.