Begin Scanning a Google Drive App
Add your Google Drive app to SaaS Security API to begin scanning and monitoring assets for possible security risks.
SaaS Security API supports both My Drive and Shared Drives. Files in My Drive are individually owned whereas files in Shared Drives belong to members of a team. Groups in a team are not supported.
To connect a Google Drive app to SaaS Security API and begin scanning assets, you need to:
- Ensure that you have a Google Drive admin account with Super Admin role.
- Add the Google Drive admin account to SaaS Security API and assign a Super Admin role.
- Add the Google Drive app to Google Marketplace and SaaS Security API.
- Grant Google Drive API access to SaaS Security API.
For information on which automated remediation capabilities SaaS Security API supports with Google Drive, refer to Supported Content, Remediation and Monitoring.
Whether files are individually owned and shared (My Drive) or belong to members in a team (Shared Drives), SaaS Security API scans and protects the assets because your end users can share data externally from Shared Drives just as easily as they can from My Drive.
Prepare To Add Google Drive App
Google’s default Super Admin role provides the necessary communication between SaaS Security API and the Google Drive app.
- Read, write, and relocate assets in the app.
- API access. API access provides visibility into the assets in Google Drive and allows SaaS Security API to monitor the sharing of assets.
- Verify that your Google Drive administrator account is assigned Super Admin role.
- Google Drive administrator account’s domain matches the existing domain on SaaS Security API.
- (Recommended) Add your Google Drive domain as an internal domain.
- Log in to Google Marketplace using an account with Super Admin role permissions.
- Go to https://gsuite.google.com/marketplace and log out of Google Marketplace to ensure that you are not logged in as a user other than an account with Super Admin role permissions.
- Log in again to Google Marketplace using an account that has Super Admin role permissions.
- Add the email address of the Google Drive administrator to SaaS Security API and assign a Super Admin role.
- Next Step: Proceed to Add Google Drive App.
Add Google Drive App
In order for SaaS Security API to scan assets, you must consent to specific permissions during the course of adding the Google Drive app.
- From theDashboard, selectAdd a Cloud App.
- SelectGoogle Driveto launch the install.
- Before you begin: As indicated in the on-screen instructions in Step 2, Prepare To Add Google Drive App.
- Follow the on-screen instructions in Step 2:Go to Google Marketplace. Afterward, theDomain Installbutton is replaced by a disabledUninstallbutton with a message that readsPlease uninstall app for domain in Admin Console. This behavior is expected.
- SelectDomain Installon the Google Marketplace page.
- ClickContinueto proceed with theDomain wide installprocess.
- Review andAcceptthe requested permissions.SaaS Security API requires these permissions to scan your assets on Google Drive. A new browser window opens in the foreground.
- Follow the on-screen instructions in Step 3:Connect to Google Drive Account.After you enter the Google Drive admin email, you are redirected toCloud Apps and Scan Settingson SaaS Security API. A message displays in a banner and the Google Drive:App installed.SaaS Security API adds the new Google Drive app to the Cloud Apps list asGoogle Driven, where n is the number of Google Drive app instances that you connected to SaaS Security API. For example, if you added one Google Drive app, the name displays asGoogle Drive 1. You’ll specify a descriptive name soon.
- Next Step: Proceed to Customize Google Drive App.
Customize Google Drive App
Customizations include modifying Google Drive app name and specifying OUs.
- (Optional) Give a descriptive name to this app instance.
- Select the Google Drive n link on the Cloud Apps list.
- Enter a descriptiveNameto differentiate this instance of Google Drive from other instances you are managing.
- (Optional) Enter theOrganizational Unitsfor OU scanning.You can enter multiple OUs including the OU name and sub-OU:
For example, your domain is companydomain.com and you want to scan three OUs—finance, operations, and marking/socialmedia OUs. Enter the OUs as a comma-separated list:/finance,/operations,/marketing/socialmedia. If you leave this field blank, all units are scanned.Backward scans and forward scans detect OU assets by querying the OUs for users, then querying for each user’s file ownership. A file is ignored if it exists in a folder that is owned by an OU user even if the file is owned by a non-OU user. However, if file ownership is subsequently changed to the OU user then the incremental scan discovers the file. The forward scan detects any changes to the OU configuration, including OUs that you add or delete in the OU scanning configuration or users that you add, move, or delete from OUs on Google Drive.
- /—Top-level of a newly-added Google App
- blank—Top-level of an existing Google App
- /Asia—A child OU of the top-level OU
- /Asia/China—China is a child OU of the Asia OU
- /Asia/India, /Europe—India is a child OU of the Asia OU and Europe is a child OU of the top-level OU
- ClickDoneto save your changes.
- Next Step: Proceed to Identify Risks.
When you add a new cloud app and enable scanning, SaaS Security API automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
- Start scanning the new Google Drive app for risks.
- During the discovery phase, SaaS Security API scans files and matches them against enabled default policy rules.Verify that your default policy rules are effective. If the results don’t capture all risks or you see false positives, proceed to the next step.
- (Optional) Modify match criteria for existing policy rules.
- (Optional) Configure or edit a data pattern.
- Next Step: Proceed to Fix Google Drive App Onboarding Issues, if necessary.
Fix Google Drive App Onboarding Issues
The most common issues related to onboarding a Google Drive app are as follows:
When you click
Connect to Google Drive Account(Step 3 of Install page), you receive an authentication error.
The Google account doesn’t have sufficient permissions to authenticate and access all the assets within Google Drive.
When you click
Connect to Google Drive Account(Step 3 of Install page), you receive a login error:
This email must be added as a Super Admin
The Google account doesn’t have an administrator account in SaaS Security API.
Make sure your Google account is super admin on SaaS Security API as outlined in Prepare To Add Google Drive App.
When you a click
Connect to Google Drive Account(Step 3 of Install page), you’re redirected to a product landing page and the Google Drive app doesn’t appear in the Cloud Apps list.
Cached files are preventing the correct redirect.
Do not log out of SaaS Security API. Instead, open SaaS Security API in an incognito window. Repeat relaunch the Install page and click on
Connect to Google Drive Account(Step 3) again. The Google Drive app now appears in the Cloud app list.
When click on
Go to Google Marketplace(Step 2 of Install page), an
Please uninstall app for domain in Admin Consolemessage displays.
This problem occurs if you complete Step 2 of Install page and either abort your install or forget to click
Connect to Google Drive Account(Step 3 of Install page).
If the Google Marketplace page is open in the same browser and session that you used when you initially added the Google Drive app, simply click
Connect to Google Drive Account.
Otherwise, delete the Google Drive app from the Google Marketplace and repeat the Google Drive app onboarding process in SaaS Security API.
Fix Google Drive Monitoring Issues
If user activities for Google Drive do not display in SaaS Security API , contact SaaS Security Technical Support to initiate appropriate troubleshooting steps. However, if requested do so by SaaS Security API Technical Support due to permissions issues, remove the API client access from Google, then authenticate the Google app again to re-enable access.
- Open a web browser and log in toadmin.google.com.
- Navigate to.Google Workspace Marketplace appsApps list
- Click onPrisma SaaS by Palo Alto Networksin the list.
- Navigate toData AccessOAuth Scopes
- SelectRevoke access.
Google Drive App Behaviors
The most common behaviors related to Google Drive app are as follows:
When you view a Goggle Drive asset in SaaS Security API, the
Createddate indicates a more current date than the
This behavior is expected due to how the Google Drive API determines timestamps.
When a user moves a file from Shared Drives to My Drive or vice versa, SaaS Security API displays
Deletein the Activity log.
Google API reported the action as a
Deletewhen actually Google did in fact
Movethe file. SaaS Security API displays in the Activity Log what Google API reports.
No known solution at this time. We communicate with our Google partner on an ongoing basis regarding its API.
Some files are shared with internal users, but SaaS Security API indicates
This behavior is expected and by design.
Recommended For You
Recommended videos not found.