icon-zia.svg
Secure Internet and SaaS Access (ZIA)

Authorizing a Custom Zscaler Connector for Google Applications

The Zscaler service supports custom, client-side connector onboarding for access to Gmail, Google Cloud Platform, Google Drive, and Google Workspace. With this functionality, instead of requiring full administrator credentials, the Zscaler service can use a minimum set of credentials to access these Google applications.

When you create a custom connector for these applications, you must configure them with the proper settings so that Zscaler can access the application.

      1. Log in to the Google Cloud Platform and select any project or create a new project within the organization.

      2. Create a service account for the selected project. In the left-side navigation, go to IAM & Admin > Service Accounts > Create Service Account.

      3. Provide a name for the service account, copy the email address, and click Create and Continue.
      4. In the Grant this service account access to project section, select the role Pub/Sub Admin and click Continue.

      5. Paste the copied email address into the Service account users role section and click Done.

      6. On the Service accounts page, note down the OAuth2 Client ID.
      7. Click the service account you created, and click the Keys tab.
      8. Click Add Key and from the drop-down list click Create new key.
      9. In the Create private key for <service account> dialog box, select the key type as JSON and click Create. The private key is downloaded to your computer. Click Close.
      Close
      1. Go to the project you created the service account in Step 1 and copy your project ID.

      2. To enable APIs for the project, from the main Google Cloud Platform page, click the Activate Cloud Shell icon.

      3. To set a default project, run the following command:

        gcloud config set project <project-id>

      4. To enable the APIs, run the following command:

        gcloud services enable admin.googleapis.com pubsub.googleapis.com gmail.googleapis.com
      5. In the left-side navigation, click APIs & Services and verify API access status.
      Close
      1. Log in to the Google Admin Console.

      2. Go to Security > Access and Data Control > API controls.

      3. Click on MANAGE DOMAIN WIDE DELEGATION.

      4. Click Add New.

      5. Add the Service Account Client ID noted down earlier to the client ID field, paste in the following scopes to the OAuth Scopes field, and click Authorize.

        For more information about the APIs or OAuth Scopes, see the API/Oauth Scope Permissions table.

        https://www.googleapis.com/auth/pubsub,
https://www.googleapis.com/auth/admin.directory.user,
https://www.googleapis.com/auth/admin.reports.audit.readonly,
https://mail.google.com/,
https://www.googleapis.com/auth/admin.reports.usage.readonly,
https://www.googleapis.com/auth/admin.directory.user.security,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/admin.directory.orgunit.readonly
      Close

      1. From the Google Admin Console, go to Account > Admin roles.

      2. Verify that you have one of the following roles:
        1. A role with Super Admin Role permissions.

        2. A custom role that has the following API permissions:

          • Organization Units > Read
          • Users > Read
          • Groups > Read

          As well as these admin console privileges:

          • Organization Units > Read
          • Users > Read
          • Groups > Read

          These can be found in the right-side navigation after clicking on the role.

      3. If you need to create a new custom role:
        1. Click Create new role from the Admin roles page.
        2. Enter a name and description for the role and click Continue.
        3. Select the same privileges listed previously in Step b, ii.
      4. Once you have the role, select it and go to Assign role > Assign members to add a user to this role.
      Close
      1. In the ZIA Admin Portal, go to Administration > SaaS Application Tenants and click Add SaaS Application Tenant.
      2. Select Gmail.
      3. Under Name the SaaS Application Tenant, enter a name for the SaaS application tenant. It must be unique. This name is displayed when configuring the Data at Rest ScanningDLP policy, Malware Detection policy, and Scan Configuration.
      4. Enter the Google Admin Email ID associated with the role you previously assigned. This value is treated as the tenant ID, and Zscaler internally fetches the tenant domain from it.

      5. Under Authorize the SaaS Application, select Custom.

      6. Upload the private key JSON file that you downloaded in Step 1 while creating a service account and click Authorize.
      7. If you want to add trusted domains or users, you can add them to either the External Trusted Domains or External Trusted User fields and click Add Items.
      8. Click Save and activate the change.
      Close
    Close

    • Start by setting up one of the following permission types:

      • With these permissions, Report Incident and Action None policy actions will function. Sign-in Events, Webhooks, and other policy actions will not function.

        1. Log in to the Google Cloud Platform.

        2. Go to your organization using the Project Selection drop-down menu and select the appropriate domain.

        3. Log in to the Google Cloud console and click Activate Cloud Shell.

        4. At the shell prompt, enter:

          nano zscaler_read_role.yaml

          Use the role name exactly as provided and do not modify or rename the role.

        5. Copy the following content into the file:

          For more information about the APIs, see the API Permissions table.

          title: "Zscaler_Read_Role"
description: "Role for supporting Zscaler for performing Storage Scan"
stage: "ALPHA"
includedPermissions:
# get IAM roles to check the Zscaler_Role is present
- iam.roles.get
- iam.roles.list
# get bucket metadata
- storage.buckets.get
# list storage buckets under the project
- storage.buckets.list
# get object metadata
- storage.objects.get
# list objects under the storage buckets
- storage.objects.list
# get project metadata and list projects under organization
- resourcemanager.projects.get
- resourcemanager.projects.getIamPolicy
# this permission is required while listing and getting metadata for folders under organization
- resourcemanager.folders.get
- resourcemanager.folders.getIamPolicy
- resourcemanager.folders.list
# this permission is required for getting the organization metadata
- resourcemanager.organizations.get
- resourcemanager.organizations.getIamPolicy
# get ACLs if any created for an object which will be used to check for visibility of the object(public/private)
- storage.objects.getIamPolicy
# get ACLs and Iam policy attached to the bucket used for checking visibility of buckets
- storage.buckets.getIamPolicy
# get all logging entries
- logging.logEntries.list
- logging.privateLogEntries.list
        6. When pasted, press CTRL+0 to write to file, press Enter to not change the file name, and press CTRL+X to exit.

        7. Run the following commands to create the role and attach it to the organization:

          1. To create a role for the first time, run the following, entering your Organization ID where indicated:
            1. Bash
            2. Copy code
            3. gcloud iam roles create Zscaler_Read_Role \
--organization=<organization-id> \
--file=zscaler_read_role.yaml
          2. To update the existing Zscaler_Read_Role, run the following, entering your Organization ID where indicated:
            1. Bash
            2. Copy code
            3. gcloud iam roles update Zscaler_Read_Role \
--organization=<organization-id> \
--file=zscaler_read_role.yaml

          To get the organization ID, click on the project at the top of the page. In the Select from window, click on the All tab and click on the organization that the project is under. The organization name has an accompanying ID.

        8. To verify the role is created, run the following command, entering your Organization ID where indicated:

          gcloud iam roles describe --organization=<organization-id> Zscaler_Read_Role
        Close

      • With these permissions, Report Incident and Action None policy actions will function. Sign-in Events and other policy actions will not function. This configuration provides connector sufficient permission to register webhooks along with keeping read role intact on Google Cloud Storage.

        1. Log in to the Google Cloud Platform.

        2. Go to your organization using the Project Selection drop-down menu and select the appropriate domain.

        3. Log in to the Google Cloud console and click Activate Cloud Shell.

        4. At the shell prompt, enter:

          nano zscaler_read_role.yaml

          Use the role name exactly as provided and do not modify or rename the role. If you do modify the Zscaler_Read_role, a scan restart is mandatory for the changes to take effect.

        5. Copy the following content into the file:

          For more information about the APIs, see the API Permissions table.

          title: "Zscaler_Read_Role"
description: "Role for supporting Zscaler for performing Storage Scan"
stage: "ALPHA"
includedPermissions:
# get IAM roles to check the Zscaler_Role is present
- iam.roles.get
- iam.roles.list
# get bucket metadata
- storage.buckets.get
# list storage buckets under the project
- storage.buckets.list
# get object metadata
- storage.objects.get
# list objects under the storage buckets
- storage.objects.list
# get project metadata and list projects under organization
- resourcemanager.projects.get
- resourcemanager.projects.getIamPolicy
# this permission is required while listing and getting metadata for folders under organization
- resourcemanager.folders.get
- resourcemanager.folders.getIamPolicy
- resourcemanager.folders.list
# this permission is required for getting the organization metadata
- resourcemanager.organizations.get
- resourcemanager.organizations.getIamPolicy
# get ACLs if any created for an object which will be used to check for visibility of the object(public/private)
- storage.objects.getIamPolicy
# get ACLs and Iam policy attached to the bucket used for checking visibility of buckets
- storage.buckets.getIamPolicy
# get all logging entries
- logging.logEntries.list
- logging.privateLogEntries.list
# webhook
# create pubsub subscription required for sending notification to Zscaler
- pubsub.subscriptions.create
- pubsub.subscriptions.delete
- pubsub.subscriptions.get
- pubsub.topics.attachSubscription
- pubsub.topics.create
- pubsub.topics.setIamPolicy
- pubsub.topics.delete
- pubsub.topics.getIamPolicy
- pubsub.topics.get
- pubsub.subscriptions.update

          When pasted, press CTRL+0 to write to file, press Enter to not change the file name, and press CTRL+X to exit.

        6. Run one of following commands to either create or update the role and attach it to the organization:

          1. To create a role for the first time, run the following, entering your Organization ID where indicated:
            1. Bash
            2. Copy code
            3. gcloud iam roles create Zscaler_Read_Role \
--organization=<organization-id> \
--file=zscaler_read_role.yaml
          2. To update the existing Zscaler_Read_Role, run the following, entering your Organization ID where indicated:
            1. Bash
            2. Copy code
            3. gcloud iam roles update Zscaler_Read_Role \
--organization=<organization-id> \
--file=zscaler_read_role.yaml

          To get the organization ID, click on the project at the top of the page. In the Select from window, click on the All tab and click on the organization that the project is under. The organization name has an accompanying ID.

        7. To verify the role is created, run the following command, entering your Organization ID where indicated:

          gcloud iam roles describe --organization=<organization-id> Zscaler_Read_Role
        Close

      • Sign-in Events will not function with these permissions.

        1. Log in to the Google Cloud Platform.

        2. Go to your organization using the Project Selection drop-down menu and select the appropriate domain.

        3. Log in to the Google Cloud console and click Activate Cloud Shell.

        4. At the shell prompt, enter:

          nano zscaler_readwrite_role.yaml

          Use the role name exactly as provided and do not modify or rename the role.

        5. Copy the following content into the file:

          For more information about the APIs, see the API Permissions table.

          title: "Zscaler_ReadWrite_Role"
description: "Role for supporting Zscaler for performing Storage Scan"
stage: "ALPHA"
includedPermissions:
# get IAM roles to check the Zscaler_Role is present
- iam.roles.get
- iam.roles.list
# get log sinks created for the project
- logging.sinks.get
# get bucket metadata
- storage.buckets.get
# list storage buckets under the project
- storage.buckets.list
# get object metadata
- storage.objects.get
# list objects under the storage buckets
- storage.objects.list
# get project metadata and list projects under organization
- resourcemanager.projects.get
- resourcemanager.projects.getIamPolicy
# this permission is required while listing and getting metadata for folders under organization
- resourcemanager.folders.get
- resourcemanager.folders.getIamPolicy
- resourcemanager.folders.list
# this permission is required for getting the organization metadata
- resourcemanager.organizations.get
- resourcemanager.organizations.getIamPolicy
# get ACLs if any created for an object which will be used to check for visibility of the object(public/private)
- storage.objects.getIamPolicy
# get ACLs and Iam policy attached to the bucket used for checking visibility of buckets
- storage.buckets.getIamPolicy
# get all logging entries
- logging.logEntries.list
- logging.privateLogEntries.list
# policy action
- storage.objects.setIamPolicy
- storage.objects.update
- storage.objects.create
- storage.objects.delete
- storage.buckets.update
- storage.buckets.setIamPolicy
# webhook
# create pubsub subscription required for sending notification to Zscaler
- pubsub.subscriptions.create
- pubsub.subscriptions.delete
- pubsub.subscriptions.get
- pubsub.topics.attachSubscription
- pubsub.topics.create
- pubsub.topics.setIamPolicy
- pubsub.topics.delete
- pubsub.topics.getIamPolicy
- pubsub.topics.get
- pubsub.subscriptions.update

          Once pasted, press CTRL+0 to write to file, press Enter to not change the file name, and press CTRL+X to exit.

        6. Run the following command to create the role and attach it to the organization:

          1. To create a role for the first time, run the following, entering your Organization ID where indicated:
            1. Bash
            2. Copy code
            3. gcloud iam roles create Zscaler_ReadWrite_Role \
--organization=<organization-id> \
--file=zscaler_readwrite_role.yaml
          2. To update the existing Zscaler_Read_Role, run the following, entering your Organization ID where indicated:
            1. Bash
            2. Copy code
            3. gcloud iam roles update Zscaler_ReadWrite_Role \
--organization=<organization-id> \
--file=zscaler_readwrite_role.yaml

          To get the organization ID, click on the project at the top of the page. In the Select from window, click on the All tab and click on the organization that the project is under. The organization name has an accompanying ID.

        7. To verify the role is created, run the following command, entering your Organization ID where indicated:

          gcloud iam roles describe --organization=<organization-id> Zscaler_ReadWrite_Role
        Close
      Close

    • In addition to creating the service account, you also download your private key, which is required later for fetching the OAuth token.

      1. Select any project within your organization’s folder and create a service account for the project. To do this, in the left-navigation menu, click Service Accounts > Create Service Account.

      2. Enter a name for the service account, copy the email address, and click Create and Continue. Click Continue without granting access or permissions to the project.

      3. Paste the copied email address from the previous step into the Service account users role field and click Done.

      4. On the Service accounts page, click the service account you created and select the Keys tab.
      5. Click Add Key from the drop-down menu and click Create new key.
      6. In the Create private key for <service account> dialog box, select the key type as JSON and click Create. The private key downloads to your computer.
      7. Click Close.
      Close

      1. Select the Details tab of the service account and copy the email address. This service account must be added as an IAM member in the organization you are setting up for storage scan.

      2. Select the organization you are setting up for storage scan. In the left-side navigation, go to IAM > Add/Grant Access.
      3. Paste the service account email address you copied in Step 1 in the New member text box of the Add members to <organization> window.
      4. Click Select a role and select Zscaler_Read_Role or Zscaler_ReadWrite_Role.
      5. Click Save.
      Close

      1. With the organization selected at the top of the page, in the left-side navigation, click Audit logs under IAM & Admin.

      2. On the Audit Logs page, search for Google Cloud Storage and Cloud Logging API and select both services.

      3. With both services selected, in the pane on the right side, select Data Write, Data Read, and Admin Read in the Log Type tab and click Save.

      Close

    • These instructions allow Zscaler to make API calls to the project resource by enabling the following Google Cloud APIs: Identity and Access Management (IAM) API, Cloud Resource Manager API, Cloud Logging API, Cloud Pub/Sub API, and Cloud Storage API.

      1. Open the GCP Cloud Console.
      2. Go to the project where you initially created the service account in Step 2 and copy it for the following steps. The Project ID is typically displayed on the main dashboard of the selected project.

      3. On the GCP Cloud Console, click the Activate Cloud Shell icon.

      4. To set a default project, run the following command:

        gcloud config set project <project-id>

      5. Enable the APIs by running the following command in a single line:

        gcloud services enable cloudresourcemanager.googleapis.com storage.googleapis.com iam.googleapis.com logging.googleapis.com pubsub.googleapis.com cloudkms.googleapis.com
      6. In the left-side navigation, click APIs & Services and verify API access status.
      Close
      1. In the ZIA Admin Portal, go to Administration > SaaS Application Tenants and click Add SaaS Application Tenant.
      2. Select Google Cloud.
      3. Under Name the SaaS Application Tenant, enter a name for the SaaS application tenant. It must be unique. This name is displayed when configuring the Data at Rest ScanningDLP policy, Malware Detection policy, and Scan Configuration.
      4. Enter the Google Cloud Admin Email ID, which should be the organization admin or user email address. This value is treated as the tenant ID, and Zscaler internally fetches the tenant domain from it.

      5. Under Authorize the SaaS Application, select Custom.

      6. Select either Read or Read Write for the Connector Role.

      7. Enter the Organization ID and if you selected Read Write as the connector role, also enter the Quarantine Bucket name.

        The organization ID can be found in the GCP Cloud Console. In the Select from window, click on the All tab and click on the organization that the project is under. The organization name has an accompanying ID.

        To learn more about the quarantine bucket, see Adding SaaS Application Tenants.

      8. Upload the private key JSON file that you downloaded in Step 2 while creating a service account and click Authorize.
      9. Click Save and activate the change.
      Close
    Close
      1. Log in to the Google Cloud Platform and select any project or create new project within the organization.

      2. Create a service account for the selected project. In the left-side navigation, go to IAM & Admin > Service Accounts > Create Service Account.

      3. Provide a name for the service account and click Create and Continue.
      4. Click Continue without granting access or permissions to the project, then click Done without granting user access to the service account.
      5. On the Service accounts page, note down the OAuth2 Client ID.
      6. Click the service account you created and click the Keys tab.
      7. Click Add Key and from the drop-down list click Create new key.
      8. In the Create private key for <service account> dialog box, select the key type as JSON and click Create. The private key is downloaded to your computer. Click Close.
      Close
      1. Go to the project you created the service account for in Step 1 and copy your project ID.

      2. To enable APIs for the project, from the main Google Cloud Platform page, click the Activate Cloud Shell icon.

      3. To set a default project, run the following command, pasting in your Project ID where indicated:

        gcloud config set project <project-id>

      4. Enable the APIs by running the following command:

        gcloud services enable admin.googleapis.com pubsub.googleapis.com drivelabels.googleapis.com drive.googleapis.com
      5. In the left-side navigation, click APIs & Services and verify API access status.
      Close
      1. Log in to the Google Admin Console.

      2. Go to Security > Access and Data Control > API controls.

      3. Click on MANAGE DOMAIN WIDE DELEGATION.

      4. Click Add New.

      5. Add the Service Account Client ID noted down earlier to the Client ID field, paste in the following scopes to the OAuth Scopes field, and click AUTHORIZE.

        For more information about the APIs or OAuth Scopes, see the API/Oauth Scope Permissions table.

        https://www.googleapis.com/auth/admin.directory.user,
https://www.googleapis.com/auth/drive,
https://www.googleapis.com/auth/admin.reports.audit.readonly,
https://www.googleapis.com/auth/admin.reports.usage.readonly,
https://www.googleapis.com/auth/admin.directory.user.security,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/admin.directory.orgunit.readonly,
https://www.googleapis.com/auth/drive.admin.labels
      Close

      1. From the Google Admin Console, go to Account > Admin roles.

      2. Verify that you have one of the following roles:
        1. A role with Super Admin Role permissions.

        2. A custom role that has the following API permissions:

          • Organization Units > Read
          • Users > Read
          • Groups > Read

          As well as these admin console privileges:

          • Services > Drive and Docs > Settings > Move any file or folder into shared drives
          • Services > Drive and Docs > Settings > Manage Labels
          • Reports

          These can be found in the right-side navigation after clicking on the role.

      3. If you need to create a new custom role:
        1. Click Create new role from the Admin roles page.
        2. Enter a name and description for the role and click Continue.
        3. Select the same privileges listed previously in Step b, ii.
      4. Once you have the role, select it and go to Assign role > Assign members to add a user to this role.
      Close
      1. In the ZIA Admin Portal, go to Administration > SaaS Application Tenants and click Add SaaS Application Tenant.
      2. Select Google Drive.
      3. Under Name the SaaS Application Tenant, enter a name for the SaaS application tenant. It must be unique. This name is displayed when configuring the Data at Rest ScanningDLP policy, Malware Detection policy, and Scan Configuration.
      4. Enter the Google Admin Email ID associated with the role you previously assigned. This value is treated as the tenant ID, and Zscaler internally fetches the tenant domain from it.

      5. Under Authorize the SaaS Application, select Custom.

      6. Upload the private key JSON file that you downloaded in Step 1 while creating a service account and click Authorize.
      7. Click Save and activate the change.
      Close
    Close
      1. Log in to the Google Cloud Platform and select any project or create new project within the organization.

      2. Create a service account for the selected project. In the left-side navigation, click IAM & Admin > Service Accounts > Create Service Account.

      3. Provide a name for the service account, copy the email address, and click Create and Continue.
      4. Click Continue and then click Done.
      5. On the Service accounts page, note down the OAuth2 Client ID.
      6. Click the service account you created and click the Keys tab.
      7. Click Add Key and from the drop-down list click Create new key.
      8. In the Create private key for <service account> dialog box, select the key type as JSON and click Create. The private key is downloaded to your computer. Click Close.
      Close
      1. Go to the project you created the service account for in Step 1 and in the left-side navigation, go to APIs & Services > Enabled APIs and services.

      2. Click on ENABLE APIS AND SERVICES.

      3. Search for Gmail in the search bar in the API Library.
      4. Click and open Gmail API.
      5. Click on Enable.
      6. Repeat the previous 3 steps for Admin SDK API and Google Drive API.
      Close
      1. Log in to the Google Admin Console.

      2. Go to Security > Access and Data Control > API controls.

      3. Click on MANAGE DOMAIN WIDE DELEGATION.

      4. Click Add New.

      5. Add the Service Account Client ID noted down earlier to the Client ID field, paste in the following scopes to the OAuth Scopes field, and click Authorize.

        For more information about the APIs or OAuth Scopes, see the API/Oauth Scope Permissions table.

        https://www.googleapis.com/auth/admin.directory.user,
https://www.googleapis.com/auth/drive,
https://www.googleapis.com/auth/admin.reports.audit.readonly,
https://www.googleapis.com/auth/admin.reports.usage.readonly,
https://mail.google.com/,
https://www.googleapis.com/auth/admin.directory.user.security,
https://www.googleapis.com/auth/admin.directory.group.readonly,
https://www.googleapis.com/auth/admin.directory.orgunit.readonly,
https://www.googleapis.com/auth/gmail.settings.sharing,
https://www.googleapis.com/auth/gmail.settings.basic
      Close

      1. From the Google Admin Console, go to Account > Admin roles.

      2. Confirm that the chosen Workspace admin account is assigned the Super Admin role.
      Close
      1. In the ZIA Admin Portal, go to Administration > SaaS Application Tenants and click Add SaaS Application Tenant.
      2. Select Google Workspace.
      3. Under Name the SaaS Application Tenant, enter a name for the SaaS application tenant. It must be unique. This name is displayed when configuring the Data at Rest ScanningDLP policy, Malware Detection policy, and Scan Configuration.
      4. Enter the Google Workspace Admin Email ID, which should be the organization admin or user email address. This value is treated as the tenant ID, and Zscaler internally fetches the tenant domain from it.

      5. Under Authorize the SaaS Application, select Custom.

      6. Upload the private key JSON file that you downloaded in Step 1 while creating a service account and click Authorize.
      7. Click Save and activate the change.
      Close
    Close

When creating custom connectors, provide the following application-specific API permissions to ensure that the Zscaler service has the access it needs.

    • Google PermissionAssociated Zscaler Actions
      https://www.googleapis.com/auth/pubsubScanning
      https://www.googleapis.com/auth/admin.directory.userScanning
      https://www.googleapis.com/auth/admin.reports.audit.readonlyScanning, Reporting
      https://mail.google.com/Scanning, Apply Label
      https://www.googleapis.com/auth/admin.reports.usage.readonlyScanning
      https://www.googleapis.com/auth/admin.directory.user.securityScanning
      https://www.googleapis.com/auth/admin.directory.group.readonlyScanning
      https://www.googleapis.com/auth/admin.directory.orgunit.readonlyScanning
      Close

      • Google PermissionAssociated Zscaler Actions
        iam.roles.getValidation
        iam.roles.listValidation
        storage.buckets.getOnboarding, Scanning
        storage.buckets.listOnboarding, Scanning
        storage.objects.getScanning
        storage.objects.listScanning
        resourcemanager.projects.getOnboarding, Scanning
        resourcemanager.projects.getIamPolicyOnboarding, Scanning
        resourcemanager.folders.getOnboarding
        resourcemanager.folders.getIamPolicyOnboarding
        resourcemanager.folders.listOnboarding
        resourcemanager.organizations.getValidation
        resourcemanager.organizations.getIamPolicyValidation
        storage.objects.getIamPolicyScanning
        storage.buckets.getIamPolicyOnboarding, Scanning
        logging.logEntries.listScanning, Reporting
        logging.privateLogEntries.listScanning, Reporting
        Close

      • Google PermissionAssociated Zscaler Actions
        iam.roles.getValidation
        iam.roles.listValidation
        storage.buckets.getOnboarding, Scanning
        storage.buckets.listOnboarding, Scanning
        storage.objects.getScanning
        storage.objects.listScanning
        resourcemanager.projects.getOnboarding, Scanning
        resourcemanager.projects.getIamPolicyOnboarding, Scanning
        resourcemanager.folders.getOnboarding
        resourcemanager.folders.getIamPolicyOnboarding
        resourcemanager.folders.listOnboarding
        resourcemanager.organizations.getValidation
        resourcemanager.organizations.getIamPolicyValidation
        storage.objects.getIamPolicyScanning
        storage.buckets.getIamPolicyOnboarding, Scanning
        logging.logEntries.listScanning, Reporting
        logging.privateLogEntries.listScanning, Reporting
        pubsub.subscriptions.createScanning, Reporting
        pubsub.subscriptions.deleteScanning, Reporting
        pubsub.subscriptions.getScanning, Reporting
        pubsub.topics.attachSubscriptionScanning, Reporting
        pubsub.topics.createScanning, Reporting
        pubsub.topics.setIamPolicyScanning, Reporting
        pubsub.topics.deleteScanning, Reporting
        pubsub.topics.getIamPolicyScanning, Reporting
        pubsub.topics.getScanning, Reporting
        pubsub.subscriptions.updateScanning, Reporting
        Close

      • Google PermissionAssociated Zscaler Actions
        iam.roles.getValidation
        iam.roles.listValidation
        logging.sinks.getReporting
        storage.buckets.getOnboarding, Scanning
        storage.buckets.listOnboarding, Scanning
        storage.objects.getScanning
        storage.objects.listScanning
        resourcemanager.projects.getOnboarding, Scanning
        resourcemanager.projects.getIamPolicyOnboarding, Scanning
        resourcemanager.folders.getOnboarding
        resourcemanager.folders.getIamPolicyOnboarding
        resourcemanager.folders.listOnboarding
        resourcemanager.organizations.getValidation
        resourcemanager.organizations.getIamPolicyValidation
        storage.objects.getIamPolicyScanning
        storage.buckets.getIamPolicyOnboarding, Scanning
        logging.logEntries.listScanning, Reporting
        logging.privateLogEntries.listScanning, Reporting
        storage.objects.setIamPolicyPolicy action
        storage.objects.updatePolicy action
        storage.objects.createPolicy action
        storage.objects.deletePolicy action
        storage.buckets.updatePolicy action
        storage.buckets.setIamPolicyPolicy action
        pubsub.subscriptions.createScanning, Reporting
        pubsub.subscriptions.deleteScanning, Reporting
        pubsub.subscriptions.getScanning, Reporting
        pubsub.topics.attachSubscriptionScanning, Reporting
        pubsub.topics.createScanning, Reporting
        pubsub.topics.setIamPolicyScanning, Reporting
        pubsub.topics.deleteScanning, Reporting
        pubsub.topics.getIamPolicyScanning, Reporting
        pubsub.topics.getScanning, Reporting
        pubsub.subscriptions.updateScanning, Reporting
        Close
      Close

    • Google PermissionAssociated Zscaler Actions
      https://www.googleapis.com/auth/admin.directory.userScanning
      https://www.googleapis.com/auth/driveScanning, Policy Actions
      https://www.googleapis.com/auth/admin.reports.audit.readonlyScanning
      https://www.googleapis.com/auth/admin.reports.usage.readonlyScanning, Reporting
      https://www.googleapis.com/auth/admin.directory.user.securityScanning
      https://www.googleapis.com/auth/admin.directory.group.readonlyScanning
      https://www.googleapis.com/auth/admin.directory.orgunit.readonlyScanning
      https://www.googleapis.com/auth/drive.admin.labelsApply Label
      Close

    • Google PermissionAssociated Zscaler Actions
      https://www.googleapis.com/auth/admin.directory.userScanning
      https://www.googleapis.com/auth/driveScanning
      https://www.googleapis.com/auth/admin.reports.audit.readonlyScanning
      https://www.googleapis.com/auth/admin.reports.usage.readonlyScanning
      https://mail.google.com/Scanning
      https://www.googleapis.com/auth/admin.directory.user.securityScanning
      https://www.googleapis.com/auth/admin.directory.group.readonlyScanning
      https://www.googleapis.com/auth/admin.directory.orgunit.readonlyScanning
      https://www.googleapis.com/auth/gmail.settings.sharingRemediation
      https://www.googleapis.com/auth/gmail.settings.basicRemediation
      Close
    Close
Related Articles
Authorizing a Custom Zscaler Connector for Microsoft ApplicationsAuthorizing a Custom Zscaler Connector for Google ApplicationsAbout SaaS Application TenantsAdding SaaS Application TenantsSaaS Application Validation Error CodesAdding Object Types for ServiceNow Tenants