Rediger

Set up the Google Workspace service for Google Drive connector ingestion

The Google Drive Microsoft 365 Copilot connector enables your organization to index files that anyone can access in Google Drive and make them available to Microsoft 365 Copilot and Microsoft Search. This article provides information about the configuration steps that Google Workspace admins need to complete to deploy the Google Drive connector.

For information about how to deploy the connector, see Google Drive connector deployment.

Prerequisites

To complete the setup steps, you must be a Google Workspace super admin, be granted access by a Google Workspace super admin, or be a user with administrative privileges.

To verify user permissions:

  1. In the Google Admin console, go to Menu > Directory > Users.
  2. Open your account page.
  3. On the User details tab, in the Admin roles and privileges section, view the roles assigned to you and the privileges inherited from those roles.

Setup checklist

The following checklist lists the steps involved in configuring the environment and setting up the connector prerequisites.

Task Role
Create a Google Cloud project Google Workspace admin
Enable Admin SDK and Drive APIs Google Workspace admin
Create a Google Cloud service account Google Workspace admin
Add OAuth 2.0 scopes to the service account Google Workspace admin
Get the OAuth 2.0 client ID Google Workspace admin

Create a Google Cloud project

The Google Drive Copilot connector requires a service account key generated by a Google Cloud Platform console project. When you deploy the connector in the Microsoft 365 admin center, you need to provide the service account key.

You can use an existing project you own, or create a new project. To create a project:

  1. Go to the Manage resources page in the Google Cloud Platform console.

  2. Select Create Project.

  3. Enter a project name, organization, and location.

    Screenshot that shows how to create a new project in Google Workspace.

  4. Note the Project ID for later use.

    Screenshot that shows how to get the project ID in Google Workspace.

  5. Select Create.

    After the project is created, you can also find the Project ID on the project settings page. On the Manage resources page, select the three-dot menu under Actions for your project, and then select Settings to view the project information.

    Screenshot that shows the Actions menu and Settings option for a project on the Google Cloud Manage resources page.

Enable required APIs

Enable the following APIs in your Google Cloud project:

For each API, open the link, and then use the project selector in the upper-left corner of the Google Cloud console to select the project you created.

Screenshot that shows how to select a Google Cloud project before enabling an API.

After selecting the correct project, select Enable on the API page. Repeat these steps for both APIs.

Screenshot that shows how to check the API enablement.

Create a Google Cloud service account

To create a Google Cloud service account:

  1. Go to the Service Accounts page.

  2. Select your project.

    Screenshot that highlights the Select a project button on the Service Accounts page.

  3. Select Create Service Account.

    Screenshot that shows how to create a new service account step2.

  4. Enter a name, ID, and optional description.

  5. Select Create and Continue.

    Screenshot that shows how to create a new service account step3.

  6. Skip Permissions and Principals with access, and then select Done.

  7. On the Service Accounts page, note the OAuth 2 Client ID for use in Add OAuth scopes to your service account. Then select the three-dot menu under Actions and select Manage Keys.

    Screenshot that highlights the OAuth 2 Client ID and Manage keys option for a service account.

  8. Select Add Key > Create New Key.

    Screenshot that shows how to get the keys step2.

  9. Choose JSON as the key type and select Create.

    Screenshot that shows how to download service account keys.

  10. A private JSON key is downloaded to your computer.

Add OAuth scopes to your service account

To add OAuth scopes to your service account:

  1. Go to the Google Admin console.

  2. Go to Security > Access and data control > API controls.

    Screenshot that shows how to add api scope step1.

  3. Select Manage Domain Wide Delegation.

    Screenshot that shows how to add api scope step2.

  4. Select Add new. In the Client ID field, enter the OAuth 2 Client ID you noted earlier, or follow the steps in Get the OAuth 2.0 client ID to find it. Then enter the following OAuth scopes:

    • https://www.googleapis.com/auth/admin.directory.user.readonly
    • https://www.googleapis.com/auth/admin.directory.group.readonly
    • https://www.googleapis.com/auth/drive.readonly
    • https://www.googleapis.com/auth/admin.reports.audit.readonly

    Note

    Legacy incremental crawl is deprecated effective May 15, 2026. The new reports API–based incremental crawl (available starting September 2025) requires adding the OAuth scope https://www.googleapis.com/auth/admin.reports.audit.readonly to the service account. To ensure incremental crawls continue to run, update all connections created before October 2025 to include this scope.

    Screenshot that shows how to add api scope.

Get the OAuth 2.0 client ID

To get the client ID:

  1. Go to the Service Accounts page.

  2. Select the project that contains your service account.

    Screenshot that shows how to select a project on the Service Accounts page.

  3. Find your service account in the list and copy the value in the OAuth 2 Client ID column.

    Screenshot that shows the selected project and the OAuth 2 Client ID column on the Service accounts page.

Authentication in Microsoft 365

Provide the following information to the admin to authenticate the connector during the admin center setup process:

  • Google Workspace domain
  • Admin email
  • JSON private key

Next step

Deploy the Google Drive connector

  • Sist oppdatert