---
title: "How to Search Google Workspace: Gmail, Drive"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/scan-google-workspace-gmail-drive"
language: "en"
last_updated: "2026-09-23T14:05:02.119Z"
---

# How to Search Google Workspace: Gmail, Drive

This article provides instructions on how to configure and authenticate Google Workspace including Gmail and Google Drive (via API), as well as scan these sources using Spirion Sensitive Data Platform

Note: **Google Workspace** was previously known as "G Suite."

### In This Article

-   Prerequisites

**Google Workspace Setup**

-   Step 1: Create a Project in Google Cloud Platform
-   Step 2: Create a Service Account
-   Step 3: Generate a P12 Key
-   Step 4: Record OAuth 2 Client ID
-   Step 5: Enable Domain-Wide Delegation in Google Admin Console
-   Step 6: Enable Required APIs
-   Step 7: Configure OAuth Consent Screen
-   Step 8: Add Scopes to the OAuth Consent Screen
-   Step 9: Verify Configuration   
     

**Configure Google Target in Sensitive Data Platform**

-   Step 1: Open the Target Configuration UI
-   Step 2: Enter Basic Target Info
-   Step 3: Choose Cloud / Google Drive as Source
-   Step 4: Provide Google Drive Service Account Details
-   Step 5: Save the Target

## Prerequisites

-   You must be signed in to **Google Cloud Platform (GCP)** as a **Super Administrator**.
-   If this is your first time using Google Cloud Platform, you must accept Google’s **Terms of Service**.
-   Access to your organization’s **Google Workspace Admin Console** is required.

## Google Workspace Setup

### Step 1: Create a Project in Google Cloud Platform

1.  Navigate to your [Google Cloud Platform (GCP) console](https://console.cloud.google.com/).
2.  Select the Google domain you would like to scan. 
3.  Select “New Project” in the top right-hand corner of the box.  
      
    ![](https://cdn-assets.productfruits.com/f4d6021a-4a0a-4730-bdbb-555795273847)
4.  Enter a **project name** and confirm that the **organization** is correct.   
      
    ![](https://cdn-assets.productfruits.com/b1e12933-d205-478c-a690-e67c6df0513f)
5.  Click **Create**.
6.  Once the project is created, click **Select Project**.  
       
    ![](https://media.userguiding.com/files/knowledge-base/95602/file-1760649122566.png)

### Step 2: Create a Service Account

To successfully search your Google Workspace, you must create a service account to authenticate in Google Workspace.

To create a service account, do the following steps:

1.  Under your project (“Spirion”), from the left side navigation menu, go to **APIs & Services → Credentials**.   
      
    ![APIs & Services, menu, Credentials option](https://media.userguiding.com/files/knowledge-base/95602/file-1760651341641.png)
2.  From the Credentials page, at the top, click **Create Credentials → Service Account**.  
       
    ![Create credentials drop-down menu, Service account option](https://media.userguiding.com/files/knowledge-base/95602/file-1760651393246.png)
3.  Enter a **name** for the service account and an optional description.
4.  -   Example: [`spirionsvc@spirion-438117.iam.gserviceaccount.com`](mailto:spirionsvc@spirion-438117.iam.gserviceaccount.com)   
          
        ![Service account name, step 1 of create service account wizard](https://media.userguiding.com/files/knowledge-base/95602/file-1760651446794.png)
5.  Click **Done** (no additional access setup is required on the next two screens).

### Step 3: Generate a P12 Key

Procedure:

1.  From the **Credentials** screen, click your newly created **service account**.   
      
    ![](https://cdn-assets.productfruits.com/c969cf50-7433-47c4-b7eb-fcbbf766ef0e)
2.  Select the **Keys** tab at the top.   
      
    ![](https://cdn-assets.productfruits.com/2dc2cb2a-bcd2-4df1-b010-4e2c0a9b8484)
3.  Click **Add Key → Create New Key**.
4.  In the pop-up window "Create private key for <service account name>," choose **P12** as the Key type.   
      
    ![](https://cdn-assets.productfruits.com/df457ee2-3945-4e1b-ae26-f6e99bb3db79)
5.  Download the **P12 key file** and note the **private key password**. 
6.  -   You need both later when configuring your Google Drive Target in the Sensitive Data Platform console.

### Step 4: Record OAuth 2 Client ID

Procedure:

1.  Back in **Credentials**, click **Manage Service Accounts**.  
       
    ![](https://cdn-assets.productfruits.com/558a96c7-9f52-4ce6-a794-0d660f7f6743)
2.  Locate your service account and make note of the **OAuth 2 Client ID**. 
3.  -   You’ll use this ID later when setting up API access.

![](https://cdn-assets.productfruits.com/5efaebd6-7033-45d6-b6d7-5db38fa80b54)

### Step 5: Enable Domain-Wide Delegation in Google Admin Console

Procedure:

1.  Log in to the [Google Workspace Admin Console](https://admin.google.com/).   
      
    ![](https://cdn-assets.productfruits.com/df65fc0c-3dcf-4076-b49f-91b4e2e9250c)
2.  Go to **Access and Data Control → API Controls (under Security)**.
3.  Select **Manage Domain-Wide Delegation**.   
      
    ![](https://cdn-assets.productfruits.com/af3d2637-6cf1-4516-b733-bfc639a09582)
4.  Click **Add New** to create a new API client.   
      
    ![](https://cdn-assets.productfruits.com/afbf3c4f-3de2-43e7-93fd-495d31c695e5)
5.  Enter the **OAuth Client ID** you recorded earlier.
6.  In the **OAuth Scopes** section, add the following scopes (one per line):   
    [https://www.googleapis.com/auth/userinfo.email](https://www.googleapis.com/auth/userinfo.email)   
    [https://mail.google.com](https://mail.google.com/)   
    [https://www.googleapis.com/auth/admin.directory.user.readonly](https://www.googleapis.com/auth/admin.directory.user.readonly)   
    [https://www.googleapis.com/auth/drive](https://www.googleapis.com/auth/drive)   
    [https://www.googleapis.com/auth/userinfo.profile](https://www.googleapis.com/auth/userinfo.profile)
7.  Click **AUTHORIZE**. Save your changes.   
      
    ![](https://cdn-assets.productfruits.com/6beb74c7-7243-468e-a8ac-8ece3439950c)
8.  Click **Edit** on the new API client to verify that the scopes were added correctly.   
      
    ![](https://cdn-assets.productfruits.com/01577390-b9e9-4f26-9783-08a4c1aeadae)

### Step 6: Enable Required APIs

Procedure:

1.  In Google Cloud, go to **APIs & Services → Library**.
2.  Search for and enable the following APIs: 
3.  -   **Admin SDK API**
    -   **Google Drive API**
    -   **Gmail API**
4.  Each API should show a status of **Enabled** once complete.   
      
    ![](https://cdn-assets.productfruits.com/033dc64c-a965-4a3a-a928-0aa485856454)  
    ![](https://cdn-assets.productfruits.com/d4f8b7b7-d36b-4481-bec0-5e00a09bcc4e)

### Step 7: Configure OAuth Consent Screen

Procedure:

1.  Under the project (“Spirion”) navigate to **APIs & Services** -> **OAuth** consent. **Note**: If you have not set up the Google Auth Platform you will be redirected to set it up.   
      
    ![](https://cdn-assets.productfruits.com/7647c018-7c0e-4863-9a0d-b1bcd31ce0e5)
2.  Select **Internal** as the user type.   
      
    ![](https://cdn-assets.productfruits.com/ede85668-c001-475a-bec2-e04a96d229b2)
3.  Fill in the following fields:
4.  1.  **App Name**
    2.  **Support Email**
    3.  Ensure the correct **Authorized Domain** is listed.
    4.  Add **Developer Contact Information**.   
          
        ![](https://cdn-assets.productfruits.com/e572e2bf-66c3-4ba8-b9d1-6fa6639da3af)
5.  Click **Save and Continue**.

### Step 8: Add Scopes to the OAuth Consent Screen

Procedure:

1.  Click **Add or Remove Scopes** and add the following( you will want to enter these into the manual field):   
    [`https://www.googleapis.com/auth/userinfo.email`](https://www.googleapis.com/auth/userinfo.email)   
    [`https://www.googleapis.com/auth/userinfo.profile`](https://www.googleapis.com/auth/userinfo.profile)   
    [`https://www.googleapis.com/auth/admin.directory.user.readonly`](https://www.googleapis.com/auth/admin.directory.user.readonly)   
    [`https://www.googleapis.com/auth/drive`](https://www.googleapis.com/auth/drive)   
    [`https://mail.google.com`](https://mail.google.com/)   
      
    ![](https://cdn-assets.productfruits.com/c1e3c02c-51a9-43ce-865f-066313243fa7)
2.  Save your changes.   
      
    ![](https://cdn-assets.productfruits.com/f1eb47eb-aba5-4d60-ac3f-b9ab4df1d7ea)

### Step 9: Verify Configuration

-   Your configuration should now display all added scopes and enabled APIs.
-   Once verified, your setup is complete — you can now connect Spirion to your **Google Drive** or **Gmail** target. ✅

## Configure Google Target in Sensitive Data Platform

Before searching Google Drive, you must create a Google Drive Target in Sensitive Data Platform.

To create the target, complete the steps below:

1.  Login to Spirion Sensitive Data Platform.
2.  Select “Data Asset Inventory” from the left side navigation menu.
3.  Select “Data Assets and Targets” from the left side navigation menu.
4.  Select the “**Targets**” tab under the ‘Data Assets and Targets’ header at top:   
      
    ![](https://cdn-assets.productfruits.com/c1f9c3d9-493e-47f6-8ad5-d32b90eb3a44)
5.  Select the blue “**Add Target**” button in the top right corner:   
      
    ![](https://cdn-assets.productfruits.com/914458c5-ec85-46fc-9faf-2de5a6e5a0fb)
6.  Select the “Cloud Source” tile from the "Add New Target" dialog and name the Target accordingly:   
      
    ![](https://cdn-assets.productfruits.com/f50bb119-006f-4c6a-b96b-209dfd3c4eaf)
7.  Select the “Google Drive” tile from the "Select a Cloud Source to Configure" dialog:   
      
    ![](https://cdn-assets.productfruits.com/cc455472-086f-4aa8-b329-0cd1e5783ba9)
8.  Fill in the following fields:   
      
    ![](https://cdn-assets.productfruits.com/26496816-331e-417d-94d8-10de7d972ef3)
9.  -   **Admin User Account Name** – Enter your Google User (often a G Suite/Google Workspace admin) account (it can be the same as the Super Administrator used in the Google Workspace Setup, above)
    -   **Service Account Email or Unique ID** – The email address of your service account.
    -   -   Example: [`my-service@project.iam.gserviceaccount.com`](mailto:my-service@project.iam.gserviceaccount.com).
        -   If you cannot find it or have closed out of it on accident, go back Google Workspace and navigate to “Managed Service Accounts” to recover it.
    -   **Key Data File** – Load the file **.p12** key file that was saved in in the Google Workspace Setup, above.
    -   **Key Data File Password** – The password that was generated/shown when you created the `.p12` key.
    -   **Private Key ID** – See step 24 of “G Suite Side Authentication” section above
    -   **Project ID** – See step 7 of “G Suite Side Authentication” section above
10.  Once entered select the “Save” button below to complete the authentication.
11.  If issues arise in completing this authentication, an error is thrown.
12.  Please document the error received and contact Spirion Support (or Professional Services, if currently engaged).

## Create a Scan to Search Google Drive

After the Admin Account is authenticated during the creation of the Google Drive “target”, you then need to create a scan to initialize the search:

1.  Log-in to Spirion Sensitive Data Platform.
2.  Select “Scans” from the left side vertical menu.
3.  Select "All Scans" from the left side vertical menu.
4.  Select the blue “Add Scan” button in the top right-hand corner:   
      
    ![](https://cdn-assets.productfruits.com/8155eb00-799c-4486-a427-6cb20df5f7e5)
5.  Provide a Title to the scan (for example, Google Drive) and select “Next”.
6.  Select “Sensitive Data Scan”.
7.  Select an existing playbook, or create a new playbook    
    (**Note**: This requires repeating steps 1-4 after creation)
8.  Select “Next”.
9.  Select the “Cloud” option.
10.  Select the “Google Drive” option.
11.  Select the agent type you would like to facilitate the search of Google Drive (On-premise or cloud), in addition to the specific agents pertinent to the type.
12.  Select “Next” to proceed to the next screen.
13.  Select the **Google Drive** target you created during the “Creation of a Google Drive Target”, and select the “Next” button to proceed to the next screen
14.  Specify the user accounts you would like to search or upload a CSV containing such a list.   
     **Note:** *When no User Accounts are specified for a target, all User Accounts are scanned.*
15.  Continue to fill out the additional options in the screens following the account designation to tailor or adjust any of the default behavior.
16.  1.  The default options suffice.
17.  Select the “Finish and Save” button to save and initiate the Google Drive scan, per the schedule dictated on the “Schedule” tab”:   
       
     ![](https://cdn-assets.productfruits.com/a7abd776-1a5b-45c3-b1af-cb0e854fc75f)

### Note about Google Mail Trash Folder

-   Note that when Spirion Sensitive Data Platform scans Google mail folders this includes the **Trash** folder.
-   The **Trash** folder cannot be excluded.