Google Workspace: Configuring the Interconnected Apps Integration

This article explains how to configure the Interconnected Apps integration for Google Workspace.

Overview

Interconnected Apps provides you with visibility into third-party plugins connected to sanctioned SaaS applications. To provide Cato with visibility of data within an app, you need to set up an integration with the required application. For more information, see Viewing and Analyzing Interconnected Apps.

To configure the Interconnected Apps integration, you need to:

Configure the integration within the SaaS application
Create the API connector in the Cato Management Application (CMA)

A CASB license is required for Interconnected Apps. For more about purchasing a CASB license, please contact your Cato representative.

Benefits of Connecting Google Workspace

After creating this connector, you can gain visibility into:

App inventory: See all OAuth apps authorized by users in your organization
Permission analysis: Understand what permissions (scopes) each app has been granted, classified as LOW / MEDIUM / HIGH
User mapping: Know which users authorized apps
Risk assessment: Identify high-risk applications with broad permissions (e.g., full Drive access, email read/write)

Configuring the Google Workspace Integration

To configure the Google Workspace integration, create a new project.

Prerequisites

You must have purchased a Google Cloud Enterprise license

Step 1: Configure the Integration in the Google Cloud Console

In the Google Cloud Console, create a Service account private key to enter into the CMA.

To configure the Google Workspace integration:

In your Google Cloud Console, click Select a Project.
Click New project.
Choose a Name and Location and click Create.
Navigate to APIs & Services > Library.
Search for Admin SDK.
Click on Admin SDK API and click Enable.
Navigate to IAM & Admin > Service Accounts.
Select the project you created in step two, and click Create service account.
Add a Service account ID and click Create and continue.
Click Done. (No role is required for this connector)
Click on the service account you created and navigate to the Keys tab,
Click Add key > Create new key.
Choose the JSON key type and click Create.

A JSON file containing the private key is downloaded.
Copy and save the Private key so it can be added to the CMA.
In the Google Admin console, navigate to Security > Access and Data Control > API control.
Under Domain wide delegation, select Manage Domain Wide Delegation.
Click Add new.
Add the Client ID of the Service Account. You can find this in the Service Account page.
Add these scopes:
1. https://www.googleapis.com/auth/admin.directory.user.readonly
2. https://www.googleapis.com/auth/admin.directory.user.security
Click Authorize.

Step 2: Create the API Connector in the CMA

After you have set up an integration with the required application, add the details in the CMA.

To create the API connector in the CMA:

From the navigation menu, click Resources > Integrations.
Click the Configured Integrations tab.
Click New.

The New Integration panel opens.
Select the SaaS Application you want to add.
In the Capability drop down select Third Party Apps.
Add the details created during step one.
Click Save.
The app is visible on the Integrated Apps table with a Connected status.

After connecting your APIs, you can track the interconnected apps on the Plugins page. Data may take a few minutes to appear.