Configure authentication to Google Workspace

Important

This feature is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage Azure Databricks previews.

This page shows how to configure Google Workspace to enable authentication from Azure Databricks for the Google Drive Audit Logs connector. Use the credentials retrieved from the steps on this page to create a Unity Catalog connection in Azure Databricks.

Prerequisites

Configure Google Workspace

The Google Drive Audit Logs connector authenticates with a Google Cloud service-account key and domain-wide delegation. The connector impersonates a Google Workspace admin to read the Drive audit activity report. For more information, see the Reports API authorization reference.

Create a service account and JSON key

  1. Go to the Google Cloud console.
  2. Select or create a project.
  3. Go to APIs & Services > Library, search for "Admin SDK API", select it, then select Enable.
  4. Go to APIs & Services > Credentials.
  5. Select Create credentials > Service account, enter a name, then select Create and continue.
  6. Select Done.
  7. Select the service account, then open the Keys tab.
  8. Select Add key > Create new key, select JSON, then select Create. Your browser downloads the JSON key. Store it securely and use it as the Service Account JSON Key on the connection page.
  9. On the service account's Details tab, note the Unique ID (the OAuth client ID). You use this value in the next step.

Authorize domain-wide delegation

  1. Sign in to the Google Admin console as a Super Admin.

  2. Go to Security > Access and data control > API controls.

  3. Under Domain wide delegation, select Manage Domain Wide Delegation.

  4. Select Add new.

  5. In Client ID, enter the service account's Unique ID from the previous step.

  6. In OAuth scopes, enter the following scope, then select Authorize:

    https://www.googleapis.com/auth/admin.reports.audit.readonly

Grant the impersonated admin the Reports privilege

  1. In the Google Workspace Admin console, identify or create an admin account for the connector to impersonate. Note its email. Use this value as the Admin Email to Impersonate on the connection page.
  2. Confirm the account has an admin role with the Reports privilege, which grants access to audit logs. See Administrator privilege definitions. Assign a custom role with only the Reports privilege rather than Super Admin.

Next steps

Create a Google Drive Audit Logs connection in Azure Databricks. See Create a Google Drive Audit Logs connection.

  • Last updated on