#Permissions for Source Google Drive

To perform Google Drive migrations, the Super Admin can refer to to connect your Google tenant to AvePoint Online Services at first. Then, you need to create a default or custom Google app profile in AvePoint Online Services > Management > App management to connect to the Google tenant.

Refer to the following sections for details about how to create a default or custom Google app profile with required permissions.

#Create a Default Google App Profile

If you want to use a default Google app profile, refer to the following creation steps and required permissions:

1. Click Create on the App management page in AvePoint Online Services.

2. In the Select services step, select a Google tenant, and choose Fly.

3. Click Next to go to the Choose setup methodstep.

4. In the Choose setup method step, select Modern mode.

5. Click Next to go to the Consent to apps step.

6. Click Consent.

7. Click Google Workspace Marketplace in the Install app window to go to Google Workspace Marketplace, and click Admin install to install the AvePoint Fly Migration app.

8. Go back to the Create app profile page and click Continue to consent in the Install app window. Then, the Google sign-in page appears.

9. On the Google sign-in page, sign in with a Super Admin account to consent to the app. Then, you can review the Google data that can be accessed by the AvePoint Fly Migration app.

10. Click Finish to consent to the AvePoint Fly Migration app, and you will be redirected to the App management page.

Refer to the following sections about permissions required for the default app.

#API Requirements

The following APIs are automatically assigned to the app after you consent the app.

API Requirements	Google Scopes Permission	Purpose
Gmail API	https://www.googleapis.com/auth/gmail.readonly	Retrieve mails and labels, including data and properties.
Gmail API	https://www.googleapis.com/auth/gmail.settings.sharing	Used to enable email forwarding.
Google People API	https://www.googleapis.com/auth/contacts.readonly	Retrieve contact groups and contacts.
Google Tasks API	https://www.googleapis.com/auth/tasks.readonly	Retrieve all tasks.
Admin SDK API	https://www.googleapis.com/auth/admin.reports.usage.readonly	Retrieve size usage of users.
Admin SDK API	https://www.googleapis.com/auth/admin.directory.resource.calendar.readonly	Retrieve resource calendars.
Admin SDK API	https://www.googleapis.com/auth/admin.directory.user.readonly	Retrieve source users.
Admin SDK API	https://www.googleapis.com/auth/admin.directory.group.readonly	Retrieve source groups.
Google Calendar API	https://www.googleapis.com/auth/calendar	Retrieve calendars and events.
Google Drive API	https://www.googleapis.com/auth/drive.readonly	Retrieve event attachments.
Enterprise License Manager API	https://www.googleapis.com/auth/apps.licensing	Retrieve license information.

#Admin Account Permissions

The Admin account permissions will be used in the following situations.

Type	Admin Account Permission	Purpose
Google Drive	Users > Read	Migrate user drives.
Google Drive	Drive and Docs > Settings	Migrate shared drives.
Google Drive	Reports	Retrieve source data.
Google Drive	Content manager of Shared Drive	Migrate shared drives.*Note: If you do not want to give the content manager access to the Admin account, you can ignore this requirement, but there must be a content manager or manager in the shared drive. The content manager or manager must be an internal user.

To give the Admin account the Content manager access to shared drives, refer to the following steps:

*Note: The user must have the admin role to provide access.

1. Go to the Google .

2. Navigate to Apps > Google Workspace > Drive and Docs.

3. Click Manage shared drives.

4. Hover your mouse over the shared drive you want to manage, and click Manage members.

5. Add the Admin account and click the down arrow () button next to the account. Then, select Content manager and click Send.

6. If the Admin account is already a member of the shared drive, select the Content manager access and click Done to save your changes.

#Create a Custom Google App Profile

To use a custom Google app profile, refer to the following steps and required permissions:

1. Click Create on the App management page in AvePoint Online Services.

2. In the Select services step, select a Google tenant, and choose Fly.

3. Click Next to go to the Choose setup methodstep.

4. In the Choose setup method step, select the Custom mode.

5. Click Next to go to the Consent to apps step.

6. In the Consent to apps step, enter the app profile name, admin account, Google service account, and private key of your app.

7. Click Finish.

Refer to the following sections about permissions required for the custom app.

#API Requirements

Make sure the following APIs are enabled in the projects where the service accounts are created.

Refer to the following steps to enable the APIs:

*Note: The user must be the project owner to enable the APIs.

1. Go to .

2. Click ENABLE APIS AND SERVICES. The API library page appears.

   

3. Click the API you want to enable respectively.

4. Click ENABLE on the top of the page to enable the corresponding API.

Make sure the API Access in your Google Workspace environment is enabled. Follow the provided by Google to ensure all your settings meet the requirements.

#Admin Account Permissions

Make sure the Admin account has the following custom roles.

Type	Admin Account Permission	Purpose
Google Drive	Users > Read	Migrate user drives.
Google Drive	Drive and Docs > Settings	Migrate shared drives.
Google Drive	Reports	Retrieve source data.
Google Drive	Content manager of Shared Drive	Migrate shared drives.*Note: If you do not want to give the content manager access to the Admin account, you can ignore this requirement, but there must be a content manager or manager in the shared drive. The content manager or manager must be an internal user.

To manage the roles of the Admin account, refer to the following steps:

*Note: The user must be the super administrator to manage roles.

1. Go to the Google .

2. Click Manage in the Users section.

3. Click the user you want to assign the roles. The user profile page appears.

4. Click the down arrow () button in the Admin roles and privileges section.

5. Click the Edit () button in the upper-right corner of the Roles section.

   

6. Click CREATE CUSTOM ROLE.

   

7. Click Create new role.

8. Enter a name for the current role, and click CONTINUE.

9. In the Admin console privileges section, select the Read privilege under the Users section. To migrate shared drives, select the Settings checkbox under the Drive and Docs section. Then, click CONTINUE.

10. Click CREATE ROLE. The custom role will be listed in the Roles section.

11. Click SAVE.

To allow users to access Google Drive with the Drive SDK API, refer to the following steps:

1. Go to the Google .

2. Navigate to Apps > Google Workspace > Drive and Docs.

3. Click Features and Applications.

4. Make sure the Allow users to access Google Drive with the Drive SDK API option is ON.

To give the Admin account the Content manager access to shared drives, refer to the following steps:

*Note: The user must have the admin role to provide access.

1. Go to the Google .

2. Navigate to Apps > Google Workspace > Drive and Docs.

3. Click Manage shared drives.

4. Hover your mouse over the shared drive you want to manage, and click Manage members.

5. Add the Admin account and click the down arrow () button next to the account. Then, select Content manager and click Send.

If the Admin account is already a member of the shared drive, select the Content manager access and click Done to save your changes.

#Google Service Account Permissions

To use a Google service account, refer to the following steps:

*Note: The user must be the project owner to manage service accounts.

1. Go to the Google .

2. Select the desired project. The accounts in the projects are displayed.

3. To create a new service account, refer to the following steps:

   *Note: If you want to use an existing service account to add the Google Workspace connection, ignore this step.

   1. Click CREATE SERVICE ACCOUNT.

      

   2. Enter a service account name.

   3. Enter the service account ID.

   4. Enter the description for the service account.

   5. Click CREATE AND CONTINUE. The service account is created.

   6. Select the Owner role to the project from the drop-down list and click CONTINUE.

   7. Click DONE.

4. A private key will be used when adding the connection. To obtain the private key of the service account, click the Actions () button of an existing service account, click Manage keys, click ADD KEY, and then select Create new key. Select the JSON type and click CREATE to download the private key file.

   *Note: If the service account key creation is disabled in your organization, enable it first by the following steps.

   1. Navigate to Google Cloud > IAM & Admin > IAM.

   2. Click the resource tab and click the domain name as the resource.

   3. 

   4. Click Grant access to access the Grant access to "[Tenant]" panel.

   5. In the Add principals field, enter the email address of the signed-in user.

   6. In the Assign roles field, select the Organization Policy Administrator role from the drop-down list.

   7. Click Save to grant the role for the user to access the selected tenant.

   8. Go to .

      *Note: Make sure the current project is the project where you create the service account.

   9. Click MANAGE POLICY.

      

   10. Select Override parent's policy to set a unique policy for this project.

       

   11. Click ADD A RULE to add a new rule.

       

   12. Select Off to disable the enforcement of the new rule, and click DONE.

       

   13. Click SET POLICY.

       *Note: If you are required to have the Organization Policy Administrator role, refer to for details.

5. Open the .json file with Notepad and find the private key after the "private_key": node. The private key will be used when adding the connection.

   

6. Go to the Google using the Super administrator credentials.

7. Navigate to Security > Overview > API controls.

8. Click MANAGE DOMAIN WIDE DELEGATION.

9. On the Domain-wide Delegation page, click Add new.

   

10. Enter the client ID of the service account in the Client ID field. The client ID can be found in the "client_id": " " node of the .json file in step 5.

11. Enter the following scopes in the OAuth scopes field:

    https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.reports.usage.readonly,https://www.googleapis.com/auth/apps.licensing

    The table below lists why the scopes are needed:

Google Scopes Permission	Purpose
https://www.googleapis.com/auth/admin.directory.user.readonly	Retrieve source users.
https://www.googleapis.com/auth/admin.directory.group.readonly	Retrieve source groups.
https://www.googleapis.com/auth/drive.readonly	Retrieve event attachments.
https://www.googleapis.com/auth/admin.reports.usage.readonly	Retrieve size usage of users.
https://www.googleapis.com/auth/apps.licensing	Retrieve license information.

12. Click AUTHORIZE.