Google Drive

Connect Google Drive to collect cloud storage provider evidence automatically.

Step-by-step guide: Connect Google Drive.

Connect with OAuth

Before you start, an administrator of Google Drive must allow third-party apps:

• If your organization restricts third-party apps: in the Google Admin console go to Menu › Security › Access and data control › API controls, click Manage App Access, then Configure new app.
• Enter Safeguard's app name or client ID, click Search, select it, choose the organizational units, and set access to Trusted or Specific Google data; click Continue and Finish. Changes can take up to 24 hours.

1. On Compliance › Connectors, open Google Drive, click Connect and choose OAuth.
2. Sign in to Google Drive and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for https://www.googleapis.com/auth/drive.readonly.
3. You return to Safeguard, and the card shows Verified once the first check succeeds.

Connect with an API token

1. In Google Drive:

   1. In the Google Cloud console, go to the Service accounts page, select your project, and click the email address of the service account Safeguard will use.
   2. Click the Keys tab, click Add key and select Create new key.
   3. Select JSON as the Key type and click Create. The key file downloads; you cannot download it again.
   4. Find the service account's client ID: as a super administrator in Google Cloud, click IAM & Admin › Service accounts › the service account, and expand Advanced settings to copy the Client ID.
   5. In the Google Admin console, go to Menu › Security › Access and data control › API controls › Manage Domain Wide Delegation.
   6. Click Add new, enter the Client ID, add the OAuth scope https://www.googleapis.com/auth/drive.readonly under OAuth Scopes, and click Authorize.

   Where to find the other values:

   • Admin email to impersonate: The email address of a Google Workspace administrator in your domain; the service account acts as this user through domain-wide delegation.

   Google Drive shows the secret only once, so copy it before you leave the page.

   Key creation can be blocked by the organization policy iam.disableServiceAccountKeyCreation (enforced by default for organizations created on or after May 3, 2024). Setting up domain-wide delegation and app access control needs a super administrator or the Service Settings administrator privilege.

   Source: docs.cloud.google.com, knowledge.workspace.google.com, knowledge.workspace.google.com, support.google.com, checked 2026-10-07.

   The permissions Safeguard needs: drive.readonly.

2. On Compliance › Connectors, open Google Drive, click Connect, choose API token and fill in:

   Field	What to enter
   Service account key (JSON)	Optional. Domain-wide delegation service account with Admin SDK Directory read-only scopes. Stored encrypted and never shown again.
   Admin email to impersonate	Optional.
   OAuth access token (optional)	Alternative: paste a short-lived OAuth token with Admin SDK Directory scopes. Stored encrypted and never shown again.

3. Click Connect with token.

Connect with the MCP server

Choose MCP server: the address https://drivemcp.googleapis.com/mcp/v1 is filled in. Sign in to Google Drive when asked. It lets Griffin AI search Google Drive; the compliance evidence comes from the OAuth or API token connection.

Frameworks

Safeguard's automated tests read Google Drive and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Cloud Storage Provider connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks