> For the complete documentation index, see [llms.txt](https://docs.teleskope.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.teleskope.ai/connectors/saas/filesharing/google-drive.md).

# Google Workspace - Drive

Enrolling Google Drive requires a Teleskope provided service account plus three actions from your Google Workspace admin:

* Domain-wide delegation for the Teleskope service account.
* An admin user in your Workspace for Teleskope, with a scoped custom role or Super Admin.
* Enrollment in Teleskope, using the IDs from the first two steps.

Before you start, get the **Service Account ID** from your Teleskope contact. It is a long number, such as `101234567890123456789`, and is unique to your Teleskope environment. Google Admin calls it the **Client ID**.

## Setup Domain Wide Delegation

1. In [Google Workspace Admin](https://admin.google.com), go to Security > Access and Data Control > API Controls > Domain Wide Delegation (manage domain wide delegation) > Add New
2. In **Client ID**, enter the Service Account ID provided by Teleskope.
3. Under Scopes, please input the following scopes separated by a comma. We need these scopes to be able to scan personal and shared drives as well as when the user last viewed those resources:
   1. <https://www.googleapis.com/auth/drive>
   2. <https://www.googleapis.com/auth/admin.directory.user.readonly>
   3. <https://www.googleapis.com/auth/admin.reports.audit.readonly>
   4. <https://www.googleapis.com/auth/admin.directory.group.readonly>
   5. <https://www.googleapis.com/auth/drive.labels.readonly>
   6. <https://www.googleapis.com/auth/drive.admin.labels.readonly>

For copy and paste:

```
https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/drive.labels.readonly,https://www.googleapis.com/auth/drive.admin.labels.readonly
```

## Create the Teleskope Admin User

Teleskope acts as this user to list other users, groups, shared drives and audit events. It must be a real user in your own Workspace, not the Teleskope service account.

1. In Google Workspace Admin, go to Directory > Users > Add new user and create a user for Teleskope, such as `googledrive@<customer-domain>`.
2. The admin account used by Teleskope will need a single Google Workspace license that supports full Shared Drive membership. (Business Standard or higher is sufficient).
3. Assign the user an admin role. We recommend the scoped custom role below. If you prefer, you can assign Super Admin instead.
4. Share the email of the admin user created above with Teleskope, for verification.

{% hint style="info" %}
**Naming the admin user.** We recommend naming this user for its function in your domain rather than after Teleskope, such as `googledrive@<customer-domain>`. Anyone reviewing access then sees an internal integration account. The name and address do not matter to Teleskope.
{% endhint %}

### Option 1 (recommended): Custom admin role

Use this option if you do not want to grant Super Admin. The role works with the domain-wide delegation scopes above, which are read-only except for the Drive scope that scanning requires.

1. In Google Workspace Admin, go to Account > Admin roles > **Create new role**.
2. Name the role, such as `Teleskope Drive Scanner`, and click **Continue**.
3. Under **Admin console privileges**, select:
   * **Organizational Units** > Read
   * **Users** > Read
   * **Groups** > Read
   * **Services** > **Drive and Docs** > Settings (all)
   * **Reports**
   * **Services** > **Data Classification** > Manage Labels
4. Click **Continue**, then **Create Role**.
5. Open the new role, go to **Admins** > **Assign users**, and assign it to the admin user you created above.

### Option 2: Super Admin role

Go to Account > Admin roles > Super Admin > Admins, and assign the admin user the Super Admin role.

{% hint style="warning" %}
**The admin user will appear in your Shared Drive permissions.** A Shared Drive has no individual file owner that Teleskope can act as. To read and classify its contents, the admin user must be added as a member of each Shared Drive. It will show as an account in those files' permissions, such as `googledrive@<customer-domain>`.
{% endhint %}

## Enroll in Teleskope

1. In the Teleskope portal, go to Settings > Connectors > Google Workspace and click **Enroll account**, or open the enrollment link your Teleskope contact provides.
2. In **Service Account ID**, enter the same ID you entered as the Client ID in Google Admin.
3. In **Admin User Email**, enter the email of the admin user you created above, such as `googledrive@<customer-domain>`.
4. Click **Enroll**.