Google Groups setup

This page describes how to install and configure the Google Groups connector. Setup takes place in Google Workspace, Google Cloud, Google Vault, and the Glean Admin Console.

To set up the Google Groups connector:

• Confirm the requirements and prerequisites.
• Confirm that Google Drive is connected.
• Configure the APIs and OAuth scopes.
• Create and share a Google Vault Matter.
• Provide the client information in Glean.

Requirements

To set up and operate the Google Groups connector, ensure that the following requirements are met.

Technical requirements

• A Google Workspace edition with Google Vault licensed and enabled.
• Access to create and manage service accounts in the GCP project where your Glean instance is hosted.
• A Glean instance with administrator access.
• The Google Vault API, Google Cloud Storage API, and Groups Settings API enabled as required.

Credential requirements

• A Google Cloud service account with Google Apps domain-wide delegation enabled.
• Preferably, the same service account used for the Google Drive integration.
• The following OAuth scopes granted to the service account:
  • https://www.googleapis.com/auth/ediscovery for the Vault API.
  • https://www.googleapis.com/auth/devstorage.read_only for Cloud Storage access.
  • https://www.googleapis.com/auth/apps.groups.settings for the Groups Settings API.
• Google Workspace administrator access to manage OAuth scopes and client delegation.

Permission requirements

• The service account must have the following Google Vault roles:
  • Manage Searches
  • Manage Matters
  • Manage Exports
• These roles let the service account create export requests, manage Matter containers, and download exported data for indexing in Glean.

Prerequisites

• Connect the Google Drive connector before setting up Google Groups.
• Confirm that Google Vault is licensed and enabled for your Workspace domain.
• Confirm that you have GCP service account credentials with domain-wide delegation.
• Identify the Directory Admin Email used for the Google Drive setup.

Configuration and setup instructions

Authentication and credentials

1. In GCP, create or select the service account used for Glean.
2. In the Google Admin Console, open Manage OAuth clients.
3. Select the client ID used for the Google Drive setup.
4. Add the following scopes:

https://www.googleapis.com/auth/ediscovery,https://www.googleapis.com/auth/devstorage.read_only,https://www.googleapis.com/auth/apps.groups.settings

5. Confirm that the service account can access the Vault APIs, create and search Matters, and manage exports.

Setup

Connect to Google Groups

Your company must use a Google Workspace plan that includes Google Vault. Google Drive must already be connected to Glean.

Connect Google Drive to Glean

For Glean to search Google Groups content, Google Drive must be a connected app in Glean. For more information, see Google Drive setup.

Enable the Vault API and Groups Settings API

As an administrator, enable the APIs needed to export conversations and retrieve group settings:

1. Google Vault API
2. Groups Settings API

Add API scopes

1. Sign in as an administrator and open Manage OAuth clients.
2. Select the client ID used for the Google Drive setup.
3. Select Edit and add these scopes:

https://www.googleapis.com/auth/ediscovery,https://www.googleapis.com/auth/devstorage.read_only,https://www.googleapis.com/auth/apps.groups.settings

4. Verify that the client has all three scopes:
   • https://www.googleapis.com/auth/ediscovery lets the client use Google Vault.
   • https://www.googleapis.com/auth/devstorage.read_only lets the client read Google Groups content from generated Vault exports.
   • https://www.googleapis.com/auth/apps.groups.settings lets the client read Google Group settings.

Grant Vault roles

1. Open the Admin roles page.
2. Create or modify a role for the Directory Admin Email.
3. Grant the role these privileges:
   • Manage Matters
   • Manage Searches
   • Manage Exports

Create a Vault Matter instance and share it

1. Open Google Vault and go to the Matters page.
2. Create a Matter, such as Glean Matter.
3. Copy the Matter ID from the URL.
4. Share the Matter with the Directory Admin Email used for the Google Drive setup:
   • Open the Matter page.
   • Select Share this matter near the pencil icon.
   • Under Invite people, add the Directory Admin Email.

Provide client information

1. In the Google Groups connector setup in Glean, enter the Matter ID in Google Vault Matter ID.
2. Enter the domain of the connected Google Drive instance in Google Domain.
3. Confirm that the domain exactly matches the domain configured for Google Drive. If you have multiple Google Drive instances, use the domain for the instance whose Google Groups conversations you want to index.
4. Select Save.

Permissions and security

• The connector indexes messages and metadata such as senders, subjects, timestamps, and permissions.
• Original system permissions are maintained through group membership and Google Groups sharing settings.
• Service accounts use tightly scoped permissions, and operations run within the customer's GCP project.
• Google Vault availability, licensing, and organization-wide export quotas can affect export frequency.
• Users only see Google Groups conversations they are authorized to access.

See also

• Google Groups overview