Google Drive setup

You're reading the new setupAlready have Google Drive connected? →

Connecting Google Drive requires one authorization step. Completing setup allows the following functionality.

• Read and write tools. Glean and Glean agents can search Drive, read and download files, and create files, docs, and sheets. Every tool runs with a user's Google authorization and Drive permissions.
• Permission-aware search. Turn on data indexing and Glean builds a search index of your Drive content. Glean mirrors Drive access controls through domain-wide delegation and enforces them at query time. Each user sees only the files they can open in Drive.

1. Connect and authorizetoday — current step
2. Use read and write toolstoday — current step
3. Indexing runs in the backgroundtoday — happens automatically
4. Permission-aware search switches ontomorrow — happens automatically

Feature availability after setup

Read and write tools are available upon connecting. Search switches on once you begin indexing and the first crawl completes.

Capability	When it becomes available	Whose permissions apply
Read and write tools	Immediately after you connect	Each user's own Google permissions, through their own Google authorization
Permission-aware search	Once you begin indexing and the first crawl completes	Drive access controls, mirrored through domain-wide delegation and enforced at query time

Indexing is optional at setup. You can begin it right away or skip it and start later from the connector page.

Connector setup

Prerequisites

Confirm the following before you begin.

Requirement	Why it is needed
A Glean admin who can add and configure connectors	Adds the Google Drive connector and authorizes it in the Admin console
A Google Super Admin, or a user with the required custom admin role	Authorizes the MCP connection and, for indexing, sets up domain-wide delegation

Step 1. Connect

In the Glean Admin console, go to Connectors and add the Google Drive connector. This step authorizes Google Drive's tools.

1. Enter a Name for the connector. This is the name your organization members see.

2. Under Select an authorization method, pick one option.

   • Central (recommended). Use Glean's managed OAuth app, which needs no configuration.
   • Custom. Use your own Google OAuth app. You provide a Client ID and Client secret.

   For Custom, always select Use this client for an AI-powered agent when creating the OAuth client in Google Cloud Console. See Create a custom OAuth client for the client setup steps.

   See Google tools setup for the full instructions.

3. Select Continue. You return to Glean to set up indexing.

Step 2. Set up indexing

To add permission-aware search, set up data indexing.

• Directory admin email. Enter a Google Super Admin, or a user with a custom admin role that has the required privileges. Glean impersonates this identity through domain-wide delegation.
• Domain-wide delegation and scopes. Add Glean's client ID and the required OAuth scopes in the Google Admin console.
• Additional domains. Retrieve domains from your Google Workspace account, or enter them manually.
• Google Group mappings. Upload a CSV that maps target audience IDs to Google Groups.
• Drive labels. Leave this on to crawl Drive labels for filters and facets, or turn it off.

Step 3. Review access and begin indexing

Review who can use the connector and any data access rules, then finish setup.

• User access. Make the connector available to all users, or to a test group only.
• Data access. Set inclusion, exclusion, and additional rules for what Glean indexes.
• Select Begin indexing to start the crawl, or Skip for now to defer it and start later from the connector page.

Create a custom OAuth client

Complete these steps if you select Custom when connecting Google Drive.

Use this setup when your organization requires a customer-owned OAuth app instead of the Glean central app. You will create an OAuth 2.0 client in Google Cloud Console and enter the credentials in Glean.

1. Enable the Google Drive API

1. Go to the Google Cloud Console and select your project.
2. Navigate to APIs & Services → Library.
3. Search for and enable the Google Drive API.

2. Enable the Drive MCP API

1. In the same project, go to APIs & Services → Library.
2. Search for and enable the Google Drive MCP API (drivemcp.googleapis.com).

Note: The Drive MCP API is currently part of the Google Workspace Developer Preview Program. Your project must be enrolled in the Developer Preview to enable this API.

3. Configure the OAuth consent screen

1. In the same project, go to APIs & Services → OAuth consent screen (or Google Auth Platform → Branding in newer console layouts).
2. If not already configured, set the User type to Internal (recommended for organization-only access) or External.
3. Fill in the required fields (app name, support email) and click Save and Continue.
4. On the Scopes page, click Add or Remove Scopes and add:
   • https://www.googleapis.com/auth/drive
5. Click Update, then Save and Continue.

Note: This single scope covers both read and write access to Google Drive and is used for MCP tools as well as other Google Drive actions in Glean.

4. Create the OAuth client credentials

Always select Use this client for an AI-powered agent when creating a custom OAuth client for Glean, so you can use it with Google Workspace MCP servers in the future. If you leave it unselected, you will need to create another client to set up MCP later.

1. Go to Google Auth Platform → Clients (or APIs & Services → Credentials).
2. Click Create client (or Create credentials → OAuth client ID).
3. For Application type, select Web application.
4. Enter a Name (e.g., "Glean Drive MCP").
5. Under Authorized redirect URIs, click + Add URI and paste the Callback URL from this setup page: Copy the Callback Url from the Glean Admin Console setup panel.
6. Select Use this client for an AI-powered agent.
7. Click Create.
8. Copy the Client ID and Client Secret — you will need them in the next step.

5. Enter credentials and connect

1. On this setup page, locate the Client ID and Client Secret fields under Custom App.
2. Paste the Client ID and Client Secret from the Google Cloud Console into the matching fields.
3. Click Connect to authenticate with your Google account.

Troubleshooting

• MCP requests rejected — In Google Auth Platform → Clients, open the OAuth client used by Glean and confirm Use this client for an AI-powered agent is selected. If you cannot change the setting, create a new OAuth client with it selected, update the credentials in Glean, and reconnect. Google starts rejecting unmarked clients on November 11, 2026. Existing clients not marked by November 12, 2026 require replacement for MCP access. See Google's announcement.

• "Access blocked" or "unverified app" error — If your OAuth consent screen is set to External and the app is not yet verified by Google, add test users under OAuth consent screen → Test users, or switch to Internal if only your organization needs access.

• "Redirect URI mismatch" — Verify the Authorized redirect URI saved on the OAuth client in Google Cloud Console matches the Callback URL shown on this page exactly, including scheme and trailing path.

• "Drive MCP API not found" — Ensure your Google Cloud project is enrolled in the Google Workspace Developer Preview Program before enabling the API.

Quick checklist

• Enable the Google Drive API in your Google Cloud project
• Enable the Google Drive MCP API (requires Developer Preview enrollment)
• Configure the OAuth consent screen with the required scopes
• Create a Web application OAuth client with the Glean callback URL as the redirect URI
• Select Use this client for an AI-powered agent before creating the client
• Copy the Client ID and Client Secret into Glean
• Click Connect to authenticate

Manage tools

Connecting Google Drive makes its tools available. You can see all available tools on the Tools tab of your connector and edit permissions through Advanced settings.

Tool settings you can change afterwards

• Which tools are on. Keep read tools enabled and leave write tools off until you are ready for agents to act in Drive. See Enabling or disabling individual tools.
• Where they appear. Across Glean Assistant, Agents, and the Glean MCP server. See Enabling tools for Chat and Agents.
• Who can use them. Scope each tool to specific users or groups. See Tool visibility scoping and role-based access to tools.
• How write tools run. Control whether a tool runs without user confirmation. See Run tools without user confirmation and Allowing in-line execution of write tools.

For the full guide, see Tools overview.

Per-user authorization

Setup authorizes Glean to Google Drive at the connector level. From there, two identities decide what each person sees.

Capability	Runs as	What it enforces
Indexed search	The Glean service account, through domain-wide delegation	Drive access controls, mirrored into the index and enforced at query time
Read and write tools	Each user's own Google account	That user's own Drive permissions, checked by Google on every call

Each teammate authorizes their own Google account over OAuth the first time they use a tool. Indexed search needs no action from end users once the crawl completes.

After setup

• Broaden coverage by adding Google Workspace domains.
• Refine what is indexed with inclusion, exclusion, and restriction rules, and Drive labels.
• Check progress from the Google Drive connector's Overview tab in the Admin console. If initial sync progress is enabled, Index readiness shows the percentage of sampled priority content indexed after discovery finishes. See Monitor initial sync readiness.

See also

• Choose your Google Drive setup shows which setup is yours and how tools and indexed search fit into each.
• Google Drive overview covers objects, crawling, permissions, and limitations.
• Connect Google Drive with Glean is the previous connector setup reference.