> For the complete documentation index, see [llms.txt](https://help.datadefender.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.datadefender.io/getting-started/linking-google-workspace/linking-google-drive-to-datadefender.md).

# Linking Google Drive to DataDefender

Use this guide to complete the Google Drive connection setup inside your DataDefender organization.

Connecting your Google Drive environment allows DataDefender to safely inventory, analyze, and classify your organization’s drives and shared drives.

### Before You Begin (Prerequisites)

Connecting Google Drive requires setup across three environments: GCP, Google Workspace, and DataDefender.

If your team hasn't completed the backend infrastructure deployment yet, start with Step 1 below. 

If your Cloud and Workspace admins have already deployed the Terraform module and authorized delegation, skip directly to Step 2.

### Step 1: Complete Prerequisites

Before filling out the form in DataDefender, ensure your team has completed the following:

1. AWS Account Connected: Your target scanning AWS Account must already be linked in DataDefender (Settings -> Cloud Connectivity).  That account must have the `File Scanning` feature set enabled.
2. GCP & Workspace Deployed: Your GCP Administrator and Workspace Super Admin must deploy the DataDefender Terraform module and authorize Domain-Wide Delegation in the Workspace Admin Console.

Need the infrastructure setup steps? Send your technical team our [GCP & Google Workspace Integration Guide](/getting-started/linking-google-workspace/connecting-google-workspace-to-datadefender.md).

### Step 2: Gather Required Values

Once Step 1 is complete, make sure you have the following details ready before filling out the connection form:

* Workspace Details: 
* Google Workspace Customer ID
* Impersonation Admin Email
* Crawler User Email.
* Terraform Outputs: The four specific values generated from your GCP deployment:
* Backend\_sa\_email
* Agent\_sa\_email
* Backend\_wif\_audience
* agent\_wif\_audience

### Connection Instructions

When you have gathered your prerequisite values, follow these steps to configure your connection in DataDefender:

Step 1: Navigate to Cloud Connectivity

1. Log in to DataDefender.
2. In the left navigation menu, go to Settings -> Cloud Connectivity.
3. Click Add New Connection.
4. Select Google Drive from the provider options to open the Connect Google Drive page.

Step 2: Configure Connection Fields

Populate the form fields using your Google Workspace details and the values generated from your Terraform output.

1\. Account Details

* Google Workspace Customer ID: Your unique Google Workspace organization ID. (If you need help finding this, refer to[ Google's Customer ID Guide](https://knowledge.workspace.google.com/admin/getting-started/find-your-customer-id)).
* Account Name: Enter a friendly display name for this connection (e.g., Corporate Google Drive).

2\. Google Workspace Settings

* Customer GCP Project ID: The Google Cloud Project ID where your team deployed the DataDefender Terraform module.
* Admin Impersonation Email: The email address of the dedicated Workspace user created for administrative discovery (e.g., <datadefender-admin@yourdomain.com>).
* Crawler User Email: The email address of the dedicated standard Workspace user created for content scanning (e.g., <datadefender-crawler@yourdomain.com>).

3\. Terraform Outputs

Enter these exact values from [your terminal output](/getting-started/linking-google-workspace/connecting-google-workspace-to-datadefender.md#setup-instructions) (terraform output `dwd_authorization_table`):

* Backend Service Account Email: Value corresponding to `backend_sa_email.`
* Agent Service Account Email: Value corresponding to `agent_sa_email.`
* Backend WIF Audience: Value corresponding to `backend_wif_audience`.
* AWS Agent WIF Audience: Value corresponding to `agent_wif_audience`.

4\. Scanning Target

* Scanning AWS Account: Select the linked AWS Account where DataDefender’s scanner agent tasks will be hosted.
* Scanning Region: Select the specific AWS region where your scanner agent tasks will deployed.

Step 3: Save & Verify Connection

1. Review all entered fields for accuracy.
2. Click Connect & Verify.

DataDefender will perform an immediate automated handshake check to confirm that Workload Identity Federation (WIF) is active and that the service accounts have access to your Google Workspace environment.

### Troubleshooting & Common Issues

| Issue                        | Likely Cause                          | Resolution                                                                                                                        |
| ---------------------------- | ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| Authentication Failed        | Incorrect WIF Audience or SA Email    | Verify the exact strings from your terraform output command and ensure no leading or trailing spaces were pasted into the form.   |
| Domain-Wide Delegation Error | Missing OAuth Scopes in Workspace     | Refer back to the GCP & Google Workspace Integration Guide and confirm both Client IDs and scopes are active in admin.google.com. |
| Access Denied Error          | Impersonation or Crawler user missing | Ensure datadefender-admin and datadefender-crawler accounts exist and are active in your Google Workspace directory.              |