AvePoint Docs
Graph API
My support tickets
Graph API
My support tickets
English

Home > Perform Microsoft Teams Migrations > Required Permissions for Microsoft Teams Migration > Destination Permissions for Google Chat Space

Export to PDF

Destination Permissions for Google Chat Space

To migrate to the destination Google Chat Space, the Super Admin can refer to  to connect your Google tenant to AvePoint Online Services at first. Then, you need to create a custom Google app profile in AvePoint Online Services > Management > App management to connect to the Google tenant.

Refer to the following section for details about how to create a custom Google app profile with required permissions.

Create a Custom Google App Profile

To use a custom Google app profile, refer to the following steps and required permissions:

Click Create on the App management page in AvePoint Online Services.

  1. In the Select services step, select a Google tenant, and choose Fly.

  2. Click Next to go to the Choose setup method step.

  3. In the Choose setup method step, select the Custom mode.

  4. Click Next to go to the Consent to apps step.

  5. In the Consent to apps step, enter the app profile name, admin account, Google service account, and private key of your app.

  6. Click Finish.

Refer to the following sections about permissions required for the custom app.

API Requirements

Make sure the following APIs are enabled in the projects where the service accounts are created.

- Admin SDK API - Google Drive API - Google Chat API - Google Sheets API

Refer to the following steps to enable the APIs:

*Note: The user must be the project owner to enable the APIs.

Go to .

  1. Click ENABLE APIS AND SERVICES. The API library page appears.

The API library.

  1. Click the API you want to enable respectively.

  2. Click ENABLE on the top of the page to enable the corresponding API.

  3. Click Google Chat API and click Manage to access the API/Service Details page.

  4. ![A screenshot of a chat

AI-generated content may be incorrect.](/en/fly-user-guide/perform-microsoft-teams-migrations/required-permissions-for-microsoft-teams-migration/images/image249.png "A screenshot of a chat

AI-generated content may be incorrect.")

  1. Click the CONFIGURATION tab and configure the application information.

    • App name – Enter a name for the app.

    • Avatar URL – Provide an icon for the app. Any valid URL is acceptable.

    • Description – Enter a brief description for the app.

    • Interactive features – Disable the Interactive features.

  2. image250

  3. Click SAVE to save the configurations.

Make sure the API Access in your Google Workspace environment is enabled. Follow the provided by Google to ensure all your settings meet the requirements.

Admin Account Permissions

Make sure the Admin account has the following custom roles.

TypeAdmin Account PermissionPurpose
Google DriveUsers > ReadMigrate to user drives.
Google DriveDrive and Docs > SettingsMigrate to shared drives.
Google DriveManager of Shared DriveMigrate to shared drives.*Note: If you do not want to give the manager access to the Admin account, you can ignore this requirement, but there must be an available manager in the shared drive.
Google ChatSettings (Read and Modify)Update the properties of Google Chat spaces.
Google ChatManage chat and spaces conversationList and manage Google Chat spaces.

To manage the roles of the Admin account, refer to the following steps:

*Note: The user must be the super administrator to manage roles.

Go to the Google .

  1. Click Manage in the Users section.

  2. Click the user you want to assign the roles. The user profile page appears.

  3. Click the down arrow (Button: down arrow) button in the Admin roles and privileges section.

  4. Click the Edit (Button: Edit) button in the upper-right corner of the Roles section.

The Roles section.

  1. Click CREATE CUSTOM ROLE.

Edit Roles section.

  1. Click Create new role.

  2. Enter a name for the current role, and click CONTINUE.

  3. In the Admin console privileges section, select the Read privilege under the Users section. To migrate shared drives, select the Settings checkbox under the Drive and Docs section. Then, click CONTINUE.

  4. Click CREATE ROLE. The custom role will be listed in the Roles section.

  5. Click SAVE.

To allow users to access Google Drive with the Drive SDK API, refer to the following steps:

Go to the Google .

  1. Navigate to Apps > Google Workspace > Drive and Docs.

  2. Click Features and Applications.

  3. Make sure the Allow users to access Google Drive with the Drive SDK API option is ON.

To give the User/Group account the Manager access to shared drives, refer to the following steps:

*Note: The user must have the admin role to provide access.

Go to the Google .

  1. Navigate to Apps > Google Workspace > Drive and Docs.

  2. Click Manage shared drives.

  3. Hover your mouse over the shared drive you want to manage, and click Manage members.

  4. Add the User/Group account and click the down arrow (Button: down arrow) button next to the account. Then, select Manager and click Send.

If the User/Group account is already a member of the shared drive, select the Manager access and click Done to save your changes.

To allow users to access Google Chat with the Chat SDK API, refer to the following steps:

  1. Go to the Google .

  2. Navigate to Apps > Google Workspace > Google Chat.

  3. Make sure the Service Status option is ON.

Google Service Account Permissions

To use a Google service account, refer to the following steps:

*Note: The user must be the project owner to manage service accounts.

Go to the Google .

  1. Select the desired project. The accounts in the projects are displayed.

  2. To create a new service account, refer to the following steps:

*Note: If you want to use an existing service account to add the Google Workspace connection, ignore this step.

Click CREATE SERVICE ACCOUNT.

The CREATE SERVICE ACCOUNT page.

1. Enter a service account name. 2. Enter the service account ID. 3. Enter the description for the service account. 4. Click **CREATE AND CONTINUE**. The service account is created. 5. Select the **Owner** role to the project from the drop-down list and click **CONTINUE**. 6. Click **DONE**.
  1. A private key will be used when adding the connection. To obtain the private key of the service account, click the Actions (Button: Actions button.) button of an existing service account, click Manage keys, click ADD KEY, and then select Create new key. Select the JSON type and click CREATE to download the private key file.

*Note: If the service account key creation is disabled in your organization, enable it first by the following steps.

1. Navigate to **Google Cloud** > **IAM & Admin** > **IAM**. 2. Click the resource tab and click the domain name as the resource.

Select a resource window.

1. Click Grant access to access the Grant access to "[Tenant]" panel. 2. In the **Add** **principals** field, enter the email address of the signed-in user. 3. In the **Assign roles** field, select the **Organization Policy Administrator** role from the drop-down list. 4. Click **Save** to grant the role for the user to access the selected tenant. 5. Go to .

*Note: Make sure the current project is the project where you create the service account.

1. Click **MANAGE POLICY**.

Clicking MANAGE POLICY.

1. Select **Override parent's policy** to set a unique policy for this project.

Selecting Override parent's policy.

1. Click **ADD A RULE** to add a new rule.

Clicking ADD A RULE.

1. Select **Off** to disable the enforcement of the new rule, and click **DONE**.

Selecting Off.

1. Click SET POLICY.

*Note: If you are required to have the Organization Policy Administrator role, refer to for details.

  1. Open the .json file with Notepad and find the private key after the "private_key": node. The private key will be used when adding the connection.

Example of private key file.

  1. Go to the Google using the Super administrator credentials.

  2. Navigate to Security > Overview > API controls.

  3. Click MANAGE DOMAIN WIDE DELEGATION.

  4. On the Domain-wide Delegation page, click Add new.

image264

  1. Enter the client ID of the service account in the Client ID field. The client ID can be found in the "client_id": " " node of the .json file in step 5.

  2. Enter the following scopes in the OAuth scopes field:

https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/apps.licensing,https://www.googleapis.com/auth/admin.reports.usage.readonly,https://www.googleapis.com/auth/chat.messages,https://www.googleapis.com/auth/chat.memberships,https://www.googleapis.com/auth/chat.admin.memberships.readonly,https://www.googleapis.com/auth/chat.spaces,https://www.googleapis.com/auth/chat.admin.spaces.readonly,https://www.googleapis.com/auth/chat.import,https://www.googleapis.com/auth/spreadsheets

The table below lists why the scopes are needed:

Google Scopes Permission Purpose
https://www.googleapis.com/auth/admin.directory.user.readonly Retrieve destination users. 
https://www.googleapis.com/auth/admin.directory.group.readonly Retrieve destination groups. 
https://www.googleapis.com/auth/driveMigrate folders and files. 
https://www.googleapis.com/auth/apps.licensing Used to retrieve license information. 
https://www.googleapis.com/auth/admin.reports.usage.readonlyRetrieve size usage of users.
https://www.googleapis.com/auth/chat.messagesOperate message.
https://www.googleapis.com/auth/chat.membershipsGet/add space member.
https://www.googleapis.com/auth/chat.admin.memberships.readonlyGet and admin space member.
https://www.googleapis.com/auth/chat.spacesGet and add space.
https://www.googleapis.com/auth/chat.admin.spaces.readonlyGet and add admin space.
https://www.googleapis.com/auth/chat.importImport space by import mode.
https://www.googleapis.com/auth/spreadsheetsMigrate metadata to Google sheets.
  1. Click AUTHORIZE.