Permissions required for the Google Drive connector

Permissions your Google Workspace administrator needs

For more information, see Resolve Google Drive security data errors.

Permissions the Code42 service account needs

As a service account, Code42 uses delegated domain-wide authority to collect file events from Google Drive. A file event is any activity observed for a file, such as creating, modifying, sharing, renaming, moving, or deleting a file. To see this file activity, Code42 requires access to your Google Drive environment.

In the configuration steps when you connect Code42 to Google Drive, Code42 provides the following scopes for you to enter in your Google Admin console:

Copy to clipboardCopied!

https://www.googleapis.com/auth/admin.directory.domain.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.customer.readonly
https://www.googleapis.com/auth/admin.reports.usage.readonly
https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/drive
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.reports.audit.readonly

Configuring these scopes in the Google Admin console gives the Code42 API client delegated domain-wide authority to your Google Drive environment, and follows Google's recommendation for allowing service accounts to read content from user drives. Because of this authority, audit logs of your Google Workspace environment may show the Code42 Cloud Service account impersonating the owner of each user drive in order to read its contents.

The Code42 data connection uses the /auth/drive scope to allow security analysts to:

• Temporarily view cloud storage files in an investigation
• View a cloud storage file's sharing permissions to assess risk when a file is shared either publicly or with untrusted users