Embedded Files
A wide range of third-party applications, including desktop and mobile apps, can connect to Google Workspace using APIs.
API scopes are a key security feature in Google Workspace. They define the precise permissions an application has when accessing data. The Gmail API, for example, offers various scopes, including https://www.googleapis.com/auth/gmail.labels for label management. For reading or sending emails, different scopes are required. It's important that each application only requests access to the data it needs.
3-Legged Authorization (3LO)
But before an application can obtain access to a Google Workspace user's managed account, the application must request access to the data (stating what access it requires), and the user must grant that access. This is done during application installation, and this flow is known as 3-legged authorization (3LO). Once authorized, the application receives a token that it uses to access that particular user's account. These tokens are known as OAuth 2.0 tokens.
As an Administrator, you can:
Enable and disable access to each API.
Create a list of trusted apps that you will allow to use disabled APIs.
Let's see the scene
Let's see the scene
In this exercise, you’ll restrict Calendar API access. You'll learn how to permit access for one trusted application and all applications created by your organization, while denying access to all other third-party applications.
Raha has emailed you regarding Calendar API access.
Exercise directions
Exercise directions
Step 1
If you’re not already signed in, sign in to your domain as the Administrator at admin.google.com.
Step 2
From the main menu, navigate to Security, then select Access and data controls, and then click API controls.
Step 3
Click on the Settings section.
Step 4
Ensure that Trust internal apps is selected.
Step 5
Navigate back to the API Controls page, and click MANAGE THIRD-PARTY APP ACCESS.
Step 6
Click Configure new app, and search for Calendar Sync in the search bar.
Step 7
Click on the Android button to filter the search by Android apps.
Step 8
Scroll down, and click on the row for the Calendar Sync app. The Client ID should be com.google.enterprise.webapp.x05d899267cd77cd5.
Step 9
From the Scope page, click CONTINUE.
Step 10
From the Access to Google Data page, select Trusted, then click Continue.
Step 11
From the Review page, review the settings you configured and click Finish.
Step 12
Go back to the API controls page and click MANAGE GOOGLE SERVICES. Hover over the Calendar row, then click Change access.
Step 13
Select Restricted: Only trusted apps can access a service, then click CHANGE.
Step 14
Click RESTRICT to confirm.
With Calendar access now restricted, only the trusted app you selected and your organization's internal apps can use the Calendar API.
Notes
Notes
If you intend to disable API access, but you want to trust some currently installed applications, add these applications to the trusted list before you disable API access to ensure these applications are not blocked.
Once you block the API/scopes, any apps that were previously using them will stop functioning. Their existing access tokens will also be revoked.
When a user tries to install an app that has a blocked scope, they’ll see the error message that you define on the App access control card.
Any applications you allow in the Google Workspace Marketplace, Android, and iOS settings pages are automatically trusted.
Help Center resources
Help Center resources
Explore more about managing connected apps with these Google resources.
Page updated
Report abuse