> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources/google/google-workspace/google-workspace-connector.md).

# Google Workspace connector

Secure sensitive data, monitor identity risks, and ensure compliance across your Google Workspace environment.

This connector includes the following capabilities and sub-capabilities (if applicable):

* **Data Security:** Scan and protect Google Workspace data across Drive, Gmail, and shared resources. This capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.
* **Identity Posture:** Maintain visibility and control over Google Workspace identities, including users, groups, roles, and privileges. This capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.
  * **Groups:** Ingest user groups from Google Workspace. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.
  * **Privileges:** Ingest privileges from Google Workspace. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.
  * **Roles:** Ingest roles from Google Workspace. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.
  * **Users:** Ingest users from Google Workspace. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud Posture Security, Cortex Cloud Runtime Security, or Cortex Data Security license.

To configure this connector, follow these steps:

#### Prerequisites

Create a service account and generate a JSON key in the Google Cloud Console. Cortex Cloud uses this service account to authenticate and access Google Workspace resources.

#### 1. Enable the Google Drive API

1. Sign in to the Google Cloud Console with an account that has the required administrative privileges.
2. From the project selector, select an existing project or create a new project.
3. Go to **APIs & Services** > **Library**.
4. Search for **Google Drive API**.
5. Select **Google Drive API**, and click **Enable**.

#### 2. Create a Service Account and Generate a JSON Key

1. Go to **APIs & Services** > **Credentials**.
2. Click **Create Credentials**, and select **Service Account**.
3. Enter a descriptive name for the service account.

   **Note:** The **Service account ID** is generated automatically based on the service account name.
4. Click **Create and Continue**, and then click **Done**.
5. Locate the newly created service account and open its details.
6. Select the **Keys** tab.
7. Select **Add Key** > **Create new key**.
8. Select **JSON**, and click **Create**.
9. Download the generated JSON key file and securely store it on your local machine.

#### 3. Configure the Google Workspace Log Collector

Configure the Google Workspace log collector before adding the Google Workspace connector. The log collector collects activity logs required for Google Drive monitoring.

1. In Cortex Cloud, go to **Settings** > **Data Sources & Integrations**.
2. Search for **Google Workspace**, hover over it, and click **Add**.
3. In the **Enable Google Workspace Log Collection** tile, enter a name for the log collector.
4. Under **Credentials**, click **Browse** and upload the service account JSON key file that you downloaded earlier.
5. Under **Capabilities**, select **Google Drive**.
6. Enter the service account email address.
7. Click **Test** to validate the connection.
8. If the connection is successful, click **Enable** to enable the log collector.

### How to configure the Google Workspace connector

#### Task 1. Select services

1. In Cortex Cloud, navigate to **Settings** → **Data Sources & Integrations**.
2. Click **+ Add new**.
3. On the **Add Data Source** page, search for **Google Workspace**, hover over it, and click **Add**.

#### Capabilities tab

1. Enter a unique name for the new connector instance.
2. Select **Data Security** and **Identity Posture**.
3. Click **Next**.

#### Connection tab

1. On the **Connection** tab, locate the **Google Workspace Admin Email** field.
2. Enter your Google Workspace administrator email address.
3. Click **Apply**.
4. Upload the JSON credentials file that you generated earlier.
5. Click **Test** to validate the connection.
6. If the connection is successful, the status displays a green **Verified** indicator.
7. Click **Next**.

#### Summary tab

1. On the **Summary** tab, verify that all selected capabilities display a **Connected** status.
2. If validation succeeds, the wizard displays a **Verification Success** message.
3. Click **Create Instance** to create the Google Workspace connector.

#### Task 2. (Optional) Post verification

After the configuration is complete, verify asset discovery and data security findings.

#### 1. Verify Discovered Assets

1. Go to **Inventory** > **All Assets**.
2. Filter the asset list by setting **Provider** to **Google Workspace**.
3. Verify that Cortex discovers the following supported asset types:
   * **Google Personal Drive:** Individual user drives that contain personal files, documents, and private folder structures.
   * **Google Shared Drive:** Organization-owned shared drives used to store collaborative documents and project content.

#### 2. Verify Security and Policy Findings

1. Select an asset to open its details panel.
2. Click the **Overview** tab to review general metadata, file counts, and finding details.
3. Go to **Findings** to review detected security findings, including:
   * **Sensitive Data Exposure:** PII, credit card numbers (PCI), Social Security numbers (SSNs), or proprietary source code detected in Google Docs, Sheets, Slides, or PDF attachments.
   * **External and Public Sharing Risks:** Files shared publicly through links, such as **Anyone with the link**, or files shared with external third-party email domains.
   * **Orphaned or Unowned File Risks:** Files owned by deleted or suspended user accounts.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/vendor-specific-data-sources/google/google-workspace/google-workspace-connector.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.