#Permissions for Destination Gmail

To migrate to destination Gmail, the Super Admin can refer to to connect your Google tenant to AvePoint Online Services at first. Then, you need to create a custom Google app profile in AvePoint Online Services > Management > App management to connect to the Google tenant.

Refer to the following section for details about how to create a custom Google app profile with required permissions.

#Create a Custom Google App Profile

To use a custom Google app profile, refer to the following steps and required permissions:

1. Click Create on the App management page in AvePoint Online Services.

2. In the Select services step, select a Google tenant, and choose Fly.

3. Click Next to go to the Choose setup methodstep.

4. In the Choose setup method step, select the Custom mode.

5. Click Next to go to the Consent to apps step.

6. In the Consent to apps step, enter the app profile name, admin account, Google service account, and private key of your app.

7. Click Finish.

Refer to the following sections about permissions required for the custom app.

#API Requirements

Make sure the following APIs are enabled in the projects where the service accounts are created.

Refer to the following steps to enable the APIs:

*Note: The user must be the project owner to enable the APIs.

1. Go to .

2. Click ENABLE APIS AND SERVICES. The API library page appears.

   

3. Click the API you want to enable respectively.

4. Click ENABLE on the top of the page to enable the corresponding API.

Make sure the API Access in your Google Workspace environment is enabled. Follow the provided by Google to ensure all your settings meet the requirements.

#Admin Account Permissions

Make sure the Admin account has the following custom roles.

Type	Admin Account Permission	Purpose
Gmail	Users > Read	Migrate Gmail mailboxes.
Gmail	Users > Update > Add/Remove Aliases	Migrate mailbox aliases
Gmail	Calendar > All Settings > Buildings and Resources > Room Insights	Migrate Gmail mailboxes.
Gmail	Groups > Update & Read	Get and add group members.
Gmail	Make changes to events permission to the calendar, or assign the Super Admin role to the Admin account.	Migrate private calendar events in the resource mailbox.

*Note: The user must have the Super Admin role to assign permissions and manage roles.

To manage the roles of the Admin account, refer to the following steps:

1. Go to the Google .

2. Click Manage in the Users section.

3. Click the user you want to assign the roles. The user profile page appears.

4. Click the down arrow () button in the Admin roles and privileges section.

5. If you need to assign the Super Admin role to the Admin account, search Super Admin in the search box, then switch on the Assigned state () button to assign the role.

6. Click SAVE.

7. Click the Edit () button in the upper-right corner of the Roles section.

   

8. Click CREATE CUSTOM ROLE in the upper-right corner of the Roles section.

   

9. Click Create new role.

10. Enter a name for the current role and click CONTINUE.

11. In the Admin console privileges section, select the Room Insights privilege under the Calendar section; and if you want to perform the data discovery, also select the Reports privilege.

12. In the Admin API privileges section, select the Read privilege under the Users section and the Read privilege under the Groups section.

13. Click CONTINUE. The selected privileges will be listed on the Review Privileges page.

14. Click CREATE ROLE.

To assign the Make changes to events permission to the Admin account, refer to the following steps to subscribe and share the calendar to the Admin account:

1. Log in to Gmail using an account with the Super Admin role.

2. Click the Google apps () button and click the Calendar app.

3. Click the add () button of the Other calendars at the bottom of the left pane, then click Browse resources.

4. Click the down arrow () button of a resource and select the calendar you want to share with the Admin account. The selected calendar will be subscribed.

5. Click the desired calendar in the Settings for my calendars section in the left pane.

6. Click Add people under the Share with specific people section on the Settings page.

7. Add the Admin account you want to share the calendar in the first text box and select Make changes to events from the permissions drop-down list.

8. Click Send.

#Google Service Account Permissions

To manage a Google service account, refer to the following steps:

*Note: The user must be the project owner to manage service accounts.

1. Go to the Google .

2. Select the desired project. The accounts in the projects are displayed.

3. To create a new service account, refer to the following steps:

   *Note: If you want to use an existing service account to add the Google Workspace connection, ignore this step.

   1. Click CREATE SERVICE ACCOUNT.

      

   2. Enter a service account name.

   3. Enter the service account ID.

   4. Enter the description for the service account.

   5. Click CREATE AND CONTINUE. The service account is created.

   6. Select the Owner role to the project from the drop-down list and click CONTINUE.

   7. Click DONE.

4. A private key will be used when adding the connection. To obtain the private key of the service account, click the Actions () button of an existing service account, click Manage keys, click ADD KEY, and then select Create new key. Select the JSON type and click CREATE to download the private key file.

   *Note: If the service account key creation is disabled in your organization, enable it first by the following steps.

   1. Navigate to Google Cloud > IAM & Admin > IAM.

   2. Click the resource tab and click the domain name as the resource.

   3. 

   4. Click Grant access to access the Grant access to "[Tenant]" panel.

   5. In the Add principals field, enter the email address of the signed-in user.

   6. In the Assign roles field, select the Organization Policy Administrator role from the drop-down list.

   7. Click Save to grant the role for the user to access the selected tenant.

   8. Go to .

      *Note: Make sure the current project is the project where you create the service account.

   9. Click MANAGE POLICY.

      

   10. Select Override parent's policy to set a unique policy for this project.

       

   11. Click ADD A RULE to add a new rule.

       

   12. Select Off to disable the enforcement of the new rule, and click DONE.

       

   13. Click SET POLICY.

5. Open the .json file with Notepad and find the private key after the "private_key": node. The private key will be used when adding the connection.

6. 

7. Go to the Google using the Super administrator credentials.

8. Navigate to Security > Overview > API controls.

9. Click MANAGE DOMAIN WIDE DELEGATION.

10. On the Domain-wide Delegation page, click Add new.

    

11. Enter the client ID of the service account in the Client ID field. The client ID can be found in the "client_id": " " node of the .json file in step 5.

12. Enter the following scopes in the OAuth scopes field:

    https://mail.google.com,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/calendar,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.resource.calendar.readonly**,**https://www.googleapis.com/auth/admin.directory.group**,**https://www.googleapis.com/auth/apps.groups.migration**,**https://www.googleapis.com/auth/contacts**,**https://www.googleapis.com/auth/tasks,https://www.googleapis.com/auth/gmail.settings.basic

    The table below lists why the scopes are needed:

Google Scopes Permission	Purpose
https://mail.google.com	Create mails and labels.
https://www.googleapis.com/auth/drive	Create folders, files, and permissions.
https://www.googleapis.com/auth/calendar	Create calendars and events.
https://www.googleapis.com/auth/admin.directory.user.readonly	List and get users in their domain for user mapping
https://www.googleapis.com/auth/admin.directory.group.readonly	List and get groups in their domain for user mapping
https://www.googleapis.com/auth/admin.directory.resource.calendar.readonly	Retrieve resource calendars.
https://www.googleapis.com/auth/admin.directory.group	Add group members
https://www.googleapis.com/auth/admin.directory.user.alias	Migrate mailbox aliases
https://www.googleapis.com/auth/apps.groups.migration	Migrate emails to Google group
https://www.googleapis.com/auth/contacts	Create contacts
https://www.googleapis.com/auth/tasks	Create tasks
https://www.googleapis.com/auth/gmail.settings.basic	Create filters

13. Click AUTHORIZE.