Google Workspace: Configuring the SaaS Posture Integration

Overview

SSPM provides visibility into the configuration and security posture of your connected SaaS applications. Cato continuously reviews the application settings and compares them to the recommended posture defined by Cato’s research team. This helps identify misconfigurations that can increase risk, such as authentication settings, third-party integrations, and data-sharing controls.

Posture data appears in the Applications dashboard, where you can view posture scores and the highest-severity findings across connected applications. You can review each posture check from the Posture page, including the issue details, status, and remediation action required to pass the check.

For more information, see Reviewing the Security Posture of Your SaaS Applications (SSPM).

To configure the SSPM integration, you need to:

Configure the required settings in the SaaS application
Create the API connector in the CMA

A SaaS Security license is required for SSPM.

Configuring the Google Workspace Integration

To configure the Gmail integration, create a new project.

Prerequisites

You must have purchased a Google Cloud Enterprise license

Step 1: Configure the Integration in the Google Cloud Console

In the Google Cloud Console, create a Service account private key to enter into the CMA.

To configure the Google Workspace integration:

In your Google Cloud Console, click Select a Project.
Click New project.
Choose a Name, Organization, and Parent resource and click Create.
Navigate to APIs & Services > Library.
Search for Admin SDK.
Click on Admin SDK API and click Enable.
Search for Cloud Identity API.
Click on Cloud Identity API and click Enable.
Navigate to IAM & Admin > Service Accounts.
Select the project you created in step two, and click Create service account.
Add a Service account ID and click Create and continue.
Click Done.
In the new service account copy and save the numeric OAuth 2.0 Client ID to be used later in the procedure.
Click on the service account you created and navigate to the Keys tab,
Click Add key > Create new key.
Choose the JSON key type and click Create.
A JSON file containing the private key is downloaded.
Copy and save the Private key so it can be added to the CMA.
n the Google Admin console, navigate to Security > Access and Data Control > API control.
Under Domain wide delegation, select Manage Domain Wide Delegation.
Click Add new.
In the Client ID field, paste the numeric OAuth 2.0 Client ID you saved above.
In the OAuth scopes field, paste the following as a single comma-separated line:
- https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/cloud-identity.policies.readonly,https://www.googleapis.com/auth/admin.directory.rolemanagement.readonly
Click Authorize.

Step 2: Create the API Connector in the CMA

After you have set up an integration with the required application, add the details in the CMA.

To create the API connector in the CMA:

From the navigation menu, click Resources > Integrations.
Click the Configured Integrations tab.
Click New.
The New Integration panel opens.
Select the SaaS Application you want to add.
Note: Enter the Private Key in JSON format.
In the Capability drop-down select SaaS Posture.
Add the details created during step one.
Note: The JSON and admin email address are the details necessary for the connector creation. The admin email field should include the email of a user with the Super Admin role.
Click Save.

The app is visible on the Integrated Apps table with a Connected status.