Skip to main content

​
After this article

You will be able to connect Google Drive to Lumos to sync Google Workspace users, Shared Drives, and Drive roles, and to provision or remove Shared Drive role assignments from Lumos.

​
Capabilities

​
Required plan and roles

  • Lumos plan: no minimum plan requirement is documented for this integration.
  • Google Workspace role: you must be a Super Admin in Google Workspace to perform the setup.
  • OAuth scopes (configured on a private OAuth application in your own Google Cloud project):
    • https://www.googleapis.com/auth/admin.directory.customer.readonly: read customer info (organization ID and domain)
    • https://www.googleapis.com/auth/admin.directory.user.readonly: list Google Workspace users in the domain
    • https://www.googleapis.com/auth/drive: read and manage Shared Drive permissions (required for provisioning Drive roles)
  • Read-only option: substitute https://www.googleapis.com/auth/drive.readonly for the drive scope to connect in read-only mode (sync only, no Drive role provisioning). The two directory scopes are read-only in both configurations.

​
Read-only access vs provisioning

Is read-only possible? Yes. Google Drive connects read-only when you authorize the drive.readonly scope instead of drive, which syncs Shared Drives and their roles without letting Lumos create or remove Drive role assignments. What read-only requires. The same private OAuth application, authorized with admin.directory.customer.readonly, admin.directory.user.readonly, and drive.readonly in place of drive. Follow the steps below, substituting the read-only Drive scope under Data Access. What full provisioning requires. The same OAuth application authorized with the full drive scope instead of drive.readonly, which lets Lumos create and delete Shared Drive permissions (Drive Roles). Watch out for. Switching between read-only and full access means re-authorizing the OAuth application with a different scope in Google Cloud, not just a setting change in Lumos. This connector never provisions or deprovisions Google Workspace user accounts themselves. Use the Google Workspace integration for user lifecycle management.

​
Instructions

Phase 1: Create a private OAuth application in Google Cloud
  1. Go to console.cloud.google.com/apis/dashboard and select the desired project.
  2. Click Enable APIs and services and enable the Admin SDK API and the Google Drive API.
  3. Search for Google Auth Platform in the same project and click Get Started. Set Audience to Internal.
  4. Under Clients, create a new client with application type Web Application. Add the Authorized Redirect URL https://app.lumosidentity.com/integrations/ics_oauth2_callback. Store the Client ID and Client Secret.
  5. Under Data Access, add the scopes listed in Required plan and roles above (use drive.readonly instead of drive for a read-only connection). Make sure to save before exiting.
Phase 2: Connect in Lumos
  1. Click the Google Drive card in your Lumos integrations.
  2. Enter the OAuth Client ID and Client Secret.
  3. Click Connect and follow the pop-up to authorize (log in as the Super Admin).

​
API Endpoints Used

​
Troubleshooting

Insufficient permissions error. Verify all required OAuth scopes were added under Data Access and authorized during the connection flow. Re-authorize with the correct scopes if any were missing, and allow 10-15 minutes for the authorization to propagate. Shared Drives not appearing. Verify your organization has Shared Drives enabled, that the Google Drive API is enabled in the project, and that the connection includes at least the drive.readonly scope. External sharing not detected. Enable Include external sharing in the sync preferences, verify the permissions API calls are succeeding, and confirm the files were explicitly shared externally. Cannot access certain Shared Drives. Some Shared Drives restrict API access. Check the drive’s access restrictions and confirm the authorizing admin can access it. Need to provision user accounts. This integration does not create or deactivate Google users. Use the Google Workspace integration for user lifecycle management, and use Google Drive for Shared Drive role visibility and assignment.