Skip to main content

Connecting Google Drive

Alex Panagides
Updated

This page explains how to connect Google Drive to mxHERO so rules can save emails and attachments to users' My Drive or to shared drives, and replace attachments with Drive links. You connect your whole Google Workspace by installing mxHERO's app from the Google Workspace Marketplace, or connect individual Google accounts.

Before you begin

  • You need Google Workspace. The organization connection uses domain-wide access, which personal Gmail accounts don't have.
  • You need a Google Workspace super administrator to install the Marketplace app, and an Owner or Administrator of your mxHERO organization.
  • Every Google Workspace domain whose users' Drives mxHERO will use must be added to your mxHERO organization. See Organization and Domains.

Choose a connection type

Google Drive for Organization Individual Google Drive account
Who connects it A Google Workspace super administrator, once Each user, through their own Google sign-in
Where files go Each sender's or recipient's My Drive, one account you choose, or a shared drive The connected user's My Drive
Shared drives Yes No
Keeps working when a user changes their password Yes No. The user must re-authorize.
Recommended for Production rules Tests only

The same Marketplace app also gives mxHERO access to Gmail mailboxes and your directory. On the dashboard the card is called Google Apps for Organization.

Note: When you pick an individual account in a rule, the dashboard shows an Important Note that individual tokens can expire without notice. Use the organization connection whenever you can.

Step 1: Install the mxHERO app from the Google Workspace Marketplace

  1. Sign in to the Admin Dashboard and open Settings › Integrations.

  2. On the Applications tab, find Google Apps for Organization ("Verify your connection with Google Apps storage, mailbox and directory.").

    Settings › Integrations › Applications tab showing Google Apps for Organization with the Not verified status and a Verify link

  3. Start the install from the card. A dialog explains the steps; click Continue.

    The Google Workspace Marketplace listing mxHERO Mail2Cloud opens in a new tab.

  4. Sign in as a Google Workspace super administrator.

  5. Click Admin install, then Continue. Don't choose Individual install; it covers only your own account.

  6. Review the data access the app requests and accept.

  7. Select Everyone at your organization, then click Finish.

You can also install it from the Google Admin console: Apps › Google Workspace Marketplace apps › Apps list › Install app, then search for mxHERO Mail2Cloud. See Google's Install Marketplace apps for your organization.

Important: If you install the app for certain organizational units or groups only, mxHERO can reach the Drives of those users only. Uploads for other users fail.

Step 2: Verify the connection in the dashboard

  1. Back on Settings › Integrations › Applications, click Verify on Google Apps for Organization.

  2. Enter the email address of a Google Workspace administrator, then continue.

    mxHERO checks that it can act as that user. It then shows the user, your organization name and your Google Customer ID.

  3. Check that the details are your production Google Workspace, then click Confirm.

The card no longer shows Not verified.

Map users to Google accounts (if needed)

With Automatically select the storage account based on sender/recipient, mxHERO writes to the Drive of the Google user whose address is the sender's or recipient's email. If a user's Google account address differs, open Settings › Accounts and Groups, click Edit on the account, enter it in Google Drive for Organizations Account, and click Save. The CSV column is driveAccount. See Managing Accounts.

The Google account's domain must be one of your mxHERO organization's domains or aliases.

Store files in a shared drive

  1. In the rule's Cloud Storage step, select Google Drive for Organization in Cloud Storage Account.

  2. Open Advanced Options. Enter the email of a user who is a member of the shared drive, then select the shared drive from the list.

    Once a shared drive is selected, the folder picker in Storage Filepath is hidden and the path starts at the shared drive's root.

  3. Finish the rule as usual.

The shared drive list is not offered when the rule uses Send the same copy of the content and attachment links to all recipients. The user you enter must be able to add files to the shared drive (for example, Contributor or higher).

Google Drive sharing for your users is set in the Google Admin console under Apps › Google Workspace › Drive and Docs › Sharing settings. Check the settings for the organizational units of the users whose Drives mxHERO writes to, and the settings of any shared drive you use.

mxHERO link type What Google must allow
Public access links Sharing outside your organization, including links that anyone can open without signing in
Organization access links (Company) Nothing extra. The link is shared with the sender's Google Workspace domain.
Recipients access links Sharing outside your organization with the recipients' addresses
Folder collaborators (no shared link) Nothing extra

If sharing outside your organization is restricted to allowlisted domains, recipient and public links work only for those domains.

Connect an individual Google Drive account

  1. Open Settings › Integrations › Accounts.

  2. Click Add Account, then select Google Drive.

    Add Account menu listing Gmail Single Account, Office 365, Box, Google Drive, OneDrive, Egnyte, Dropbox and Egnyte Gov

  3. Sign in with the Google account and allow the requested access.

The account appears with provider Google Drive, type Storage Service and status Synced. If your Google Workspace blocks unconfigured third-party apps, an administrator must allow mxHERO in Security › Access and data control › API controls first.

Verify

  1. Google Apps for Organization shows no Not verified warning.

  2. In a rule's Cloud Storage step, Google Drive for Organization is listed as Synced. If it shows Not synced with Authorize, the app is not installed or not verified.

    Cloud Storage Account list in a rule showing organization accounts with Synced or Not synced status and Authorize buttons

  3. Send a test message, then check that the file is in the user's Drive or the shared drive and that the link opens. See Testing Mail Flow.

  • Public, Company and recipient links are supported. Company links are shared with the sender's domain.
  • Recipient links give each recipient read access without a Google notification email. If Google refuses, mxHERO retries and lets Google send its notification email.
  • Expiration works for recipient links only. 7 days expiration public access links is not available for Google Drive.
  • Passwords and prevent download are not available.
  • Recipient roles: Co-owner maps to organizer, Editor to writer, Viewer and Previewer to reader.

See Link Security Options by Provider.

How Google Drive behaves

  • Existing files. By default a file with the same name gets a new revision. With Do not overwrite existing files on, mxHERO saves name_v1.ext, name_v2.ext, and so on.
  • Names. mxHERO removes # and other characters that are unsafe in file names. See File and Folder Naming Rules.
  • Large files. Google's upload client chooses a resumable upload when needed.
  • Metadata. Google Drive doesn't receive mxHERO metadata or template metadata.
  • Throughput. Up to 8 uploads at a time per account. See Storage Load Balancing.

Troubleshooting

Symptom or code Cause Fix
APP_IS_NOT_INSTALLED when you verify The Marketplace app is not installed for your domain, or the install has not taken effect yet. Do Step 1 with Admin install. Google can take a while to apply it; try Verify again later.
USER_MUST_BE_ADMIN The email you entered is not a Google Workspace administrator. Verify with an administrator's email address.
CHECK_ACCOUNT_ACCESS mxHERO could not act as the user you entered. Check that the user exists, is active, and is in an organizational unit where the app is installed.
Domain … not in organization or Domain … not found (401 or 404) The user's domain is not a domain or alias of your mxHERO organization. Add the domain. See Organization and Domains.
invalid_user The Google user doesn't exist or is suspended. Fix the user in Google, map a different account, or use a specific storage account in the rule.
invalid_grant or access_denied for every user The app was removed or its access was turned off in the Google Admin console. mxHERO does not email anyone in this case. Reinstall the app (Step 1) and verify again.
Recipient link not created; Email Flow Logs show cannotEditExpirationOnInheritedPermission A parent folder is already shared with the recipient with different permissions, so Google won't set an expiration. Save to a folder that isn't shared with recipients, or remove the expiration from the Security Definition.
invalidSharingRequest Google refused to share without a notification email. No action. mxHERO retries with Google's notification email. If it still fails, check external sharing settings.
Individual account shows Not synced The user's token expired or was revoked. See Re-authorizing Storage Accounts.

For other upload errors, see Storage Upload Failures.

Comments

0 comments

Please sign in to leave a comment.

Powered by Zendesk