Allow Code42 access to Gmail

Step 1: Connect Code42 to Gmail

1. Sign in to the Code42 console.
2. Add the Gmail connection:
   1. Select Administration > Integrations > Data Connections.
   2. Click Add data connection.
      The Add data connection panel opens.
   3. From Data connection, select Google Gmail under Email services.
      Note the Client ID and OAuth scopes details that appear on the bottom of the screen. You enter this information into the Google Admin console later in this procedure.
   4. Enter a display name. This display name must be unique.
      
3. Authorize the Code42 app in Google:
   1. Go to your Google Admin console and log in using your Google Workspace administrator username and password. This email address must be associated with a Google Workspace administrator that has the Super Admin role.
      Requires Super Admin role
      This email address must be associated with a Google Workspace administrator that has the Super Admin role.
   2. Go to Security > Access and data control > API controls.
   3. In the Domain wide delegation panel, click Manage domain wide delegation.
      The Domain-wide delegation page displays.
   4. Click Add new.
      The Add a new client ID window displays.
   5. Copy the Client ID from the Code42 console and paste it in the Client ID field.
   6. Copy the OAuth scopes from the Code42 console and paste it in the OAuth scopes (comma-delimited) field.
   7. Click Authorize.
      The Code42 email service is added to the API client table.

Step 2: Add users

1. Return to the Code42 console.
2. In Add data connection, select I've completed these steps under Complete these steps in Google Workspace and then click Continue.
   The Add users panel appears.
   
3. Select one of the following options:
   • All: Monitors emails for all users with Gmail accounts in your environment.
   • Specific users: Monitors only the Gmail user accounts you designate.
     1. Click Upload .CSV file.
     2. Select a .csv file containing a list of only those Gmail users you want to monitor. For details, see Upload a .csv file listing Gmail account users below.
   • Specific groups: Monitors only the users with Gmail accounts that are in the Google groups you designate.
     1. Click Upload .CSV file.
     2. Select a .csv file containing a list of Google groups. Gmail account users that are in those groups are monitored by Code42. For details, see Upload a .csv file listing Google groups below.

Step 3: Verify your Google Workspace administrator email

1. In Add data connection, click Continue.
   The Verify panel appears.
   
2. Enter the Google Workspace username that you used earlier to log in to the Google Admin console.
   Requires Super Admin role
   This email address must be associated with a Google Workspace administrator that has the Super Admin role.
3. Click Authorize.
   Gmail is added as an email data connection.

Next steps

Once you have added Gmail as a data connection, learn more about:

• Common use cases for investigating security incidents with Forensic Search
• How to use Forensic Search

Upload a .csv file listing Gmail account users

To create a list of Gmail users, see Google Workspace Admin Help. Create a .csv file from this list that contains only the users with Gmail accounts that you want to monitor. Code42 reads usernames from column headers labeled Email Address [Required], Email Address, or Emails in the .csv file. If these columns contain any entries that aren't email addresses, the upload produces an error.

Upload a .csv file listing Google groups 

To create a Google group, see the Google Workspace Learning Center. After your Google groups are set up, create a .csv file that contains only the groups you want to monitor. In this file, use column headers to identify either the name or the email addresses of those groups.

• Code42 reads the names of groups from the column header labeled Group Name or Groups. Specify the names of the groups exactly as they appear in the Google Admin console.
• Code42 reads a list of email addresses associated with a group from the column header labeled Email or Email Address. In the .csv file, specify the email address associated with each group.

If the .csv file does not contain at least one of these column headers, the upload produces an error.

Code42 scans those groups to identify their users with Gmail accounts and then monitors only those email accounts. Code42 looks for users associated with Google groups as follows:

• When a group's name or email address is provided, Code42 attempts to look up users associated with that group name or group email address.
• If the group includes another group name or email address (a "nested" group), Code42 looks up users associated with that nested group as well.
• If the group name or email address cannot be found, Code42 proceeds to the next entry in the .csv file. Code42 looks for that group or email address again every 24 hours.

As users are added and removed from the monitored groups, Code42 detects these changes within 24 hours and adjusts monitoring of user email accounts accordingly.

Permissions your Google Workspace administrator needs

Permissions the Code42 service account needs

When a user emails an attachment, we collect information about the attached file and the sender and recipients for the email. To see this file activity, Code42 requires access to your Gmail environment. 

In the configuration steps above, Code42 provides the client ID and scopes for you to enter in your Google Admin console. Code42 uses the following scopes: 

Copy to clipboardCopied!

https://www.googleapis.com/auth/admin.directory.customer.readonly
https://www.googleapis.com/auth/admin.directory.group.member.readonly
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/gmail.readonly

Slowed performance

Email domain already exists

Data connection is already registered or the email address is not valid

There is an issue with the connection

Reconfigure scoping for user and group monitoring