Gmail provisioning setup
* Important note:
Due to the specific mechanism of Google CSE for this Gmail feature, any setup or configuration changes may take up to 24 hours to take effect.
I. Set up KMS KACLS Service for Google Workspace
Emails utilizing the wrap/unwrap mechanism must ensure they share the same Key service (KMS KACLS Service URL) in order to successfully send and receive emails to one another.
II. Enable Gmail CSE
Admins must enable Gmail CSE to use this feature
III. Get service account from Admin Google Cloud
Note: you must have role Organization Policy Administrator (roles/orgpolicy.policyAdmin) to get Service account key.
IV. Grant permissions to use Service Account in KMS
For Client ID: this information can be retrieved from the newly created Service Account or the downloaded JSON file
For OAuth scopes: https://www.googleapis.com/auth/gmail.settings.basic
V. Get credentials at KMS system
Admins must upload the retrieved Service Account (JSON) to the KMS, which will then generate a CA certificate required for further configuration in the Google Admin Console.
V. Setup provisioning job for email
Note: To ensure a successful KACLS connection, Admins must verify that all emails share the same Key Service access. Furthermore, the Key Service in use must match the configuration in the Google Admin Console.
Last updated