SaaS Security Administrator's Guide
    : Begin Scanning a Gmail App
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. SaaS Security Administrator's Guide
    4. Data Security
    5. Secure Sanctioned SaaS Apps on Data Security
    6. Add Cloud Apps to Data Security
    7. Begin Scanning a Gmail App
    Download PDF

    SaaS Security Administrator's Guide

    Begin Scanning a Gmail App

    Table of Contents

    Begin Scanning a Gmail App

    Add your Gmail app to
    Data Security
     to begin scanning and monitoring assets for possible security risks.
    To connect a Gmail app to
    Data Security
     and begin scanning assets, you need to:
    • Have an admin account with the required privileges.
    • Add the Google admin account to
      Data Security
       and assign a Super admin role.
    • Add the Gmail app to Google Marketplace and
      Data Security
      .
    • Grant Gmail API access to
      Data Security
      .
    Ensure that the
    Super Admin
     account added to the Strata Cloud Manager for onboarding Gmail app has logged in at least once into the Strata Cloud Manager. Only then will the account be enabled. Onboarding will fail if this account has never logged into the Strata Cloud Manager.
    Support for automated remediation capabilities varies by SaaS application.

    Prepare To Add Gmail App

    To communicate between
    Data Security
     and Gmail, you need to have custom admin privileges.
    • Read, write, and relocate assets in the app.
    • API access. API access provides visibility into the assets in Gmail and allows
      Data Security
       to monitor the sharing of assets.
    1. Verify that your Google administrator account is assigned a custom admin role.
    2. Ensure that Google administrator account’s domain matches the existing domain on
      Data Security
      .
    3. (
      Recommended
      ) Add your Gmail domain as an internal domain.
    4. Log in to Google Marketplace using an admin account with Super admin role permissions.
      1. Go to Google Workspace Marketplace and log out of Google Marketplace to ensure that you're not logged in as a user other than an account with Super admin role permissions.
      2. Log in again to Google Marketplace using an account that has Super admin role permissions.
    5. Add the email address of the custom admin to
      Data Security
       and assign a
      Superuser
       role.
    6. Next step
      : Proceed to Add Gmail App.

    Add Gmail App

    For
    Data Security
     to scan assets, you must consent to specific permissions during adding the Gmail app.
    1. Log on to SaaS Security. Go to
      Data Security
      Applications
      Add Application
      Gmail
      .
    2. As indicated in the onscreen instructions in
      Step 1
      , Prepare To Add Gmail App, if you haven’t already done so.
    3. Follow the onscreen instructions in
      Step 2
      :
      Go to Google Marketplace
      . Afterward, the
      Domain Install
       button is replaced by a disabled
      Uninstall
       button with a message that reads
      Please uninstall app for domain in Admin Console
      . This behavior is expected.
      1. Select
        Domain Install
         on the Google Marketplace page.
        Don't go to the link provided. Doing so aborts the onboarding process. If you inadvertently do so, simply repeat the process starting with Add Gmail App.
      2. Click
        Continue
         to proceed with the
        Domain wide install
         process.
      3. Review and
        Accept
         the requested permissions.
        Data Security
         requires these permissions to scan your assets on Gmail. A new browser window opens in the foreground.
      4. Click
        Done
        .
    4. Follow the onscreen instructions in
      Step 3
      :
      Connect to Gmail Account
      .
      After you enter the Gmail admin email, you're redirected to
      Cloud Apps and Scan Settings
       on
      Data Security
      . A message displays in a banner and the Gmail:
      App installed
      .
      Data Security
       adds the new Gmail app to the Cloud Apps list as
      Gmail
       n, where n is the number of Gmail app instances that you connected to
      Data Security
      . For example, if you added one Gmail app, the name displays as
      Gmail 1
      . You’ll specify a descriptive name soon.
    5. Next step
      : Proceed to Start Scanning and Monitor Results and begin scanning your assets.

    Troubleshooting Onboarding for Gmail App

    To ensure that your app has onboarded correctly without any issues in authentication or permissions, Data Security performs validation checks between the onboarding and scanning process. You can start scanning only after a successful validation. For Gmail, the following three validations happen:
    • App Authentication
    • User Permission
    • Validating Permissions
    After the validation is successful, Data Security displays the sample data assets and sample user activities.
    If the
    App Authentication
    ,
    User Permission
    , or
    Validating Permissions
     checks fail, try the following:
    1. Ensure you have administrator permissions.
    2. Go to the Google Admin Console and check if Palo Alto Networks application is listed in the list of Google Workspace Marketplace Apps. Following are the app names for specific regions:
      • India region: Prisma SaaS Gmail
      • Australia region: Palo Alto Networks - SaaS Security (Data)- Gmail
      • Japan region: Palo Alto Networks-SaaS Security (Data)-JP Gmail
      • UK region: Palo Alto Networks-SaaS Security (Data)-UK Gmail
      • EU region: SaaS Security EU by Palo Alto Networks
      • APAC region: Prisma SaaS Gmail APAC by Palo Alto Networks
      • VPC: SaaS Security Gmail by Palo Alto Networks
      • FEDM region: Palo Alto Networks - SaaS Security FEDM- Gmail
    Handling Errors
    To understand your error messages and ways to resolve them, see:
    The other most common issues related to onboarding a Gmail app are as follows:
    Symptom
    Explanation
    Solution
    When you click
    Connect to Gmail Account
     (Step 3 of the Install page), you receive an authentication error.
    The Google account doesn’t have sufficient permissions to authenticate and access all the assets within Gmail.
    Make sure your Google account is an administrator with default super admin role or applicable custom role with the permission outlined in Create Custom Admin Roles.
    When you click
    Connect to Gmail Account
     (Step 3 of Install page), you receive a login error:
    This email must be added as a Super Admin
    The Google account doesn’t have an administrator account in
    Data Security
    .
    Make sure your Google account is super admin on
    Data Security
     as outlined in Add Gmail App.
    When you click
    Connect to Gmail Account
     (Step 3 of Install page), you’re redirected to a product landing page, and the Gmail app doesn’t display in the Cloud Apps list.
    Cached files are preventing the correct redirect.
    Don't log out of
    Data Security
    . Instead, open
    Data Security
     in an incognito window. Repeat relaunch the Install page and click on
    Connect to Gmail Account
     (Step 3) again. The Gmail app now appears in the Cloud app list.
    When click on
    Go to Google Marketplace
     (Step 2 of Install page), a
    Please uninstall app for domain in Admin Console
     message displays.
    This usually occurs if you previously installed the app and deleted it from
    Data Security
     but did not delete it from Google Marketplace.
    Delete the app from the Google Marketplace, then you’ll be able to Add Gmail App in
    Data Security
    .
    This problem occurs if you complete step 2 of Install page and either abort your install or forget to click
    Connect to Google Drive Account
     (Step 3 of Install page).
    If the Google Marketplace page is open in the same browser and session that you used when you initially added the Gmail app, simply click
    Connect to Gmail Account
    .
    Otherwise, delete the Gmail app from the Google Marketplace and repeat the Gmail app onboarding process in
    Data Security
    .
    If the issue persists, contact SaaS Security Technical Support.

    Start Scanning and Monitor Results

    When you add a new cloud app and enable scanning,
    Data Security
     automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
    1. Start scanning the new Gmail app for risks.
    2. During the discovery phase,
      Data Security
       scans files and matches them against enabled default policy rules.
      Verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, proceed to the next step.
    3. (
      Optional
      ) Add new policy rules.
      Consider the business use of your app, then identify risks unique to your enterprise. As necessary, add new:
    4. (
      Optional
      ) Configure or edit a data pattern.
      You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.
    5. Next step
      : Proceed to Customize Gmail App.

    Customize Gmail App

    If you plan to manage more than one instance of the Gmail app, consider differentiating your instances.
    1. (
      Optional
      ) Give a descriptive name to this app instance.
      1. Select the Gmail n link on the Cloud Apps list.
      2. Enter a descriptive
        Name
        .
      3. Click
        Done
         to save your changes.
    2. Next step
      : Proceed to Start Scanning and Monitor Results.

    Create Domain Wide Delegation

    You need domain wide delegation to make API calls to Google and fetch user data. To implement domain wide delegation, perform the following steps.
    1. Log in to the Google Admin Console as a super user and select
      Security
      Access and data control
      API controls
      MANAGE DOMAIN WIDE DELEGATION
      Add new
      .
    2. Enter the client ID that is applicable for your region:
      • NAM: 101758057381597102755
      • EU: 107302012290887199743
      • APAC: 102431511463016019359
      • IN: 113162770221785136577
      • AU: 115902749905704876540
      • JP: 103755143451773842949
      • UK: 117282843217256637356
      • FEDM: 117466562875859030537
    3. Enter the following comma-delimited OAuth scopes and click
      AUTHORIZE
      .
      • https://www.googleapis.com/auth/admin.directory.group.readonly
      • https://www.googleapis.com/auth/admin.directory.user.readonly
      • https://www.googleapis.com/auth/admin.reports.audit.readonly
      • https://www.googleapis.com/auth/gmail.readonly

    Create Custom Admin Roles

    To avoid using a super admin account for Gmail onboarding, you can create a custom admin role with the least required privileges for successful onboarding. To create custom admin roles:
    1. Go to the Google Admin Console and select
      Account
      Admin roles
      Create new role
      .
    2. Enter a name and description and click
      Continue
      .
    3. Select the following privileges:
      • Admin console privileges
        • Organizational Units > Read
        • Users > Read
        • Reports
      • Admin API privileges
        • Organizational Units > Read
        • Users > Read
        • Groups > Read
    4. After creating the role, assign a member to the created role.
    5. Add the same user email to the
      Gmail Administrator Email
       field in SaaS Security Gmail App onboarding UI and click
      Connect
      . For an existing instance of Gmail app, you cannot edit the email address in the Cloud Management Console. So, edit it from the SaaS Security Console.

    Grant Access to Reduced Privileges

    1. This step is applicable only for existing instances of the Gmail app.
      To grant access to the reduced privileges, from the Google Admin Console, go to
      Apps
      Google Workspace marketplace apps
      Apps List
      . Select the SaaS Security App from the list and click
      Grant Access
      .

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.