> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Drive

## After this article

You will be able to connect Google Drive to Lumos to sync Google Workspace users, Shared Drives, and Drive roles, and to provision or remove Shared Drive role assignments from Lumos.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User accounts (user provisioning is handled by the Google Workspace integration, not this one) |
| Drive Roles | Permission | Yes | Yes | Roles on Shared Drives |
| Drives | Permission | Yes | No | Shared Drives |

## Required plan and roles

* **Lumos plan:** no minimum plan requirement is documented for this integration.
* **Google Workspace role:** you must be a **Super Admin** in Google Workspace to perform the setup.
* **OAuth scopes** (configured on a private OAuth application in your own Google Cloud project):
  * `https://www.googleapis.com/auth/admin.directory.customer.readonly`: read customer info (organization ID and domain)
  * `https://www.googleapis.com/auth/admin.directory.user.readonly`: list Google Workspace users in the domain
  * `https://www.googleapis.com/auth/drive`: read and manage Shared Drive permissions (required for provisioning Drive roles)
* **Read-only option:** substitute `https://www.googleapis.com/auth/drive.readonly` for the `drive` scope to connect in read-only mode (sync only, no Drive role provisioning). The two directory scopes are read-only in both configurations.

## Read-only access vs provisioning

**Is read-only possible?** Yes. Google Drive connects read-only when you authorize the `drive.readonly` scope instead of `drive`, which syncs Shared Drives and their roles without letting Lumos create or remove Drive role assignments.

**What read-only requires.** The same private OAuth application, authorized with `admin.directory.customer.readonly`, `admin.directory.user.readonly`, and `drive.readonly` in place of `drive`. Follow the steps below, substituting the read-only Drive scope under Data Access.

**What full provisioning requires.** The same OAuth application authorized with the full `drive` scope instead of `drive.readonly`, which lets Lumos create and delete Shared Drive permissions (Drive Roles).

**Watch out for.** Switching between read-only and full access means re-authorizing the OAuth application with a different scope in Google Cloud, not just a setting change in Lumos. This connector never provisions or deprovisions Google Workspace user accounts themselves. Use the Google Workspace integration for user lifecycle management.

## Instructions

**Phase 1: Create a private OAuth application in Google Cloud**

1. Go to [console.cloud.google.com/apis/dashboard](https://console.cloud.google.com/apis/dashboard) and select the desired project.
2. Click **Enable APIs and services** and enable the **Admin SDK API** and the **Google Drive API**.
3. Search for **Google Auth Platform** in the same project and click **Get Started**. Set **Audience** to **Internal**.
4. Under **Clients**, create a new client with application type **Web Application**. Add the Authorized Redirect URL `https://app.lumosidentity.com/integrations/ics_oauth2_callback`. Store the **Client ID** and **Client Secret**.
5. Under **Data Access**, add the scopes listed in **Required plan and roles** above (use `drive.readonly` instead of `drive` for a read-only connection). Make sure to save before exiting.

**Phase 2: Connect in Lumos**

1. Click the Google Drive card in your Lumos integrations.
2. Enter the **OAuth Client ID** and **Client Secret**.
3. Click **Connect** and follow the pop-up to authorize (log in as the Super Admin).

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Insufficient permissions error.** Verify all required OAuth scopes were added under **Data Access** and authorized during the connection flow. Re-authorize with the correct scopes if any were missing, and allow 10-15 minutes for the authorization to propagate.

**Shared Drives not appearing.** Verify your organization has Shared Drives enabled, that the Google Drive API is enabled in the project, and that the connection includes at least the `drive.readonly` scope.

**External sharing not detected.** Enable **Include external sharing** in the sync preferences, verify the permissions API calls are succeeding, and confirm the files were explicitly shared externally.

**Cannot access certain Shared Drives.** Some Shared Drives restrict API access. Check the drive's access restrictions and confirm the authorizing admin can access it.

**Need to provision user accounts.** This integration does not create or deactivate Google users. Use the Google Workspace integration for user lifecycle management, and use Google Drive for Shared Drive role visibility and assignment.