Requires the Essential tier or above.
Drive Management uses a service account from your own Google Cloud project rather than the default shared one. This gives it access to scopes that cannot be added to the default setup, and keeps the Drive API work for your domain in your own project. Domain-wide delegation is required before Drive Management will work.
Configure the service account in CloudM
- Go to Settings > Domain Settings > Domain Wide Delegation.
- Upload your service account.
- Run validation with the Drive Management option selected.
Delegate the scopes in Google
In the Google Admin console, the service account's client ID needs both of these scopes delegated to it:
https://www.googleapis.com/auth/drive
https://www.googleapis.com/auth/cloud-identity.orgunitsThe Cloud Identity API and the Google Drive API also need to be enabled in the Google Cloud project that hosts the service account.
Both scopes are required and there is no fallback. The cloud-identity.orgunits scope is what allows a shared drive to be created or moved between organisational units. If it is missing, those two actions fail straight away rather than falling back to the default service account.
Credentials are cached, so allow a few minutes after changing the service account or its scopes before testing.
Next step
Once validation passes, turn on shared drive sync.
Related articles