# Google - Authentication

## Authentication

Under CASB, select Google. Self-enroll with the URL or send it to your Google admin.

<figure><img src="/files/FzB0XU92xb5x1MvBiLKj" alt=""><figcaption><p>Google Authentication Link to be used by Admin</p></figcaption></figure>

Your Google admin will need to copy & paste permissions into the Google admin console (Underneath API Controls -> [Domain-Wide Delegation](https://admin.google.com/u/0/ac/owl/domainwidedelegation))

<figure><img src="/files/O3LR9yEioSaSv2kifK3g" alt=""><figcaption><p>Admins must copy/paste this information into the Workspace Admin Console</p></figcaption></figure>

{% hint style="info" %}
These are the required Google scopes

"<https://www.googleapis.com/auth/drive>", "<https://www.googleapis.com/auth/admin.directory.user>", "<https://www.googleapis.com/auth/admin.directory.domain.readonly>", "<https://www.googleapis.com/auth/admin.directory.customer.readonly>", "<https://www.googleapis.com/auth/drive.activity.readonly>", "<https://www.googleapis.com/auth/admin.directory.group.readonly>", "<https://www.googleapis.com/auth/admin.directory.user.readonly>", "<https://www.googleapis.com/auth/admin.directory.user.security>", "<https://www.googleapis.com/auth/admin.reports.audit.readonly>", "<https://www.googleapis.com/auth/gmail.settings.basic>",
{% endhint %}

<table><thead><tr><th width="307">Scope</th><th>Purpose</th></tr></thead><tbody><tr><td><p>admin.directory.user</p><p>admin.directory.domain.readonly admin.directory.customer.readonly<br>admin.directory.group.readonly<br>admin.directory.user.readonly</p></td><td>Retrieves group member information for user/group import, identify posture (2FA/Admin) for CASB Neural SSPM</td></tr><tr><td>admin.directory.user.security</td><td>Retrieves OAuth tokens and allows deletion for CASB Neural SSPM</td></tr><tr><td>admin.reports.audit.readonly</td><td>Retrieves logs for OAuth apps for CASB Neural SSPM</td></tr><tr><td>gmail.settings.basic</td><td>Retrieves mail rules (not email content) to find suspicious mail rules for CASB Neural SSPM</td></tr><tr><td>drive<br>drive.activity.readonly</td><td>Retrieves drive information for CASB Neural DLP</td></tr></tbody></table>

About Google Admin Console Configuration

{% hint style="warning" %}
To complete authorization the Google admin will need to copy & paste the scopes into the Google Admin Console. You must be a Google admin to continue.
{% endhint %}

Because of CASB Neural's sensitive permissions, the scopes are added to Domain Wide Delegation page. It's under: [Security > API Controls > MANAGE DOMAIN WIDE DELEGATION](https://admin.google.com/ac/owl/domainwidedelegation) in the Google Admin Console.

From here, you will add a new domain-wide delegation to their account. This includes CASB Neural's client ID and the required scopes (provided).

{% hint style="info" %}
See Google help docs [here](https://developers.google.com/identity/protocols/oauth2/service-account#delegatingauthority)
{% endhint %}

### Google Workspace Super Admin Email

The final step is to provide the Google Workspace super admin email

<figure><img src="/files/R5tq52nBM6MloaxYecKx" alt=""><figcaption><p>Add the super admin email used here.</p></figcaption></figure>

Once the correct email is entered, you're done! It's that simple. dope.security will now scan your tenant, uncover any publicly shared files with sensitive data, and classify them.

{% hint style="info" %}
**SSPM Coming Soon:** Uncover all third-party apps connected to your Microsoft 365 or Google SaaS tenant, neatly organized by access type: global, limited, or login access.
{% endhint %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://inflight.dope.security/dope.console/casb-neural/google-authentication.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.