Connecting to Google Drive as a knowledge source for employee service AI agents (EAP)

For employee service (ES) AI agents, Knowledge admins can connect to Google Drive as a knowledge source. The connection uses single sign-on (SSO) with an OAuth 2.0 authorization flow and includes the option to connect using resource-level permissions (RLP) for access permissions managed at the resource level.


What's my plan?







Employee Service Suite

Growth, Professional, Enterprise, or Enterprise Plus







Summary: ◀▼
You can connect Google Drive as a knowledge source for employee service AI agents using single sign-on and OAuth 2.0. Applying resource-level permissions ensures file access respects Google Drive's settings, enhancing security. Use shared drives with proper viewing permissions and assign a read-only access admin role for restricted access connections. This setup helps control information visibility and keeps sensitive data protected within your company.





Location: Admin Center > AI > AI agents > Sources

For employee service (ES) AI agents, Knowledge admins can connect to Google Drive as a
knowledge source. The connection uses single sign-on (SSO) with an OAuth 2.0 authorization
flow and includes the option to connect using resource-level permissions (RLP) for access
permissions managed at the resource level.
The connection uses the connecting user's credentials and requires several read scopes. The
connection allows these items to be surfaced in ES AI agents according to the applied
permissions.
Files
Folders
Contacts


This article contains the following topics:

Understanding the Google Drive connection and
how Google Drive permissions work within employee service AI Agents
Applying permissions in Google
Drive
Configuring resource-level permissions (RLP)
before connecting to Google Drive
Connecting to Google Drive for employee
service AI agents

Related article:
Creating, deploying and editing employee service AI agents
(EAP)




Understanding the Google Drive connection and how Google Drive permissions work within employee service AI Agents

The Google Drive connection is established through single sign-on (SSO) with an OAuth 2.0
authorization flow. This process uses the connecting user's credentials and requires the
following read scopes:
https://www.googleapis.com/auth/drive.photos.readonly
https://www.googleapis.com/auth/contacts.readonly
https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/drive.metadata.readonly
https://www.googleapis.com/auth/drive.activity.readonly
openid
email
profile


In addition, you can apply a resource-level permission (RLP) connection type (restricted
access) that ensures shared links respect the permissions set in Google Drive, rather than
relying only on the permissions of the connector's account. It is recommended that you use
the restricted access approach to ensure secure, granular permissions are applied before
information sources are displayed to users.
It is important for your company's information security that you understand how permissions
are managed in Google Workspace at your company and ensure that permissions are carefully
managed within the source to ensure information is only viewable by the intended audience.
When connecting Google Drive to ES AI agents, make sure you understand the intended
audience for the information, and ensure that you have applied the appropriate permissions
directly in the drive. Ensure the permissions model applied in the drive matches the
permissions type (either restricted access or open to everyone) being applied when the
connection is made.
If the connection is open to everyone, but the drive has restricted access, the ES AI agent
will still surface the relevant information in its response, based on the viewing
permissions of the account used to create the connection. However, if a user does not have
viewing permissions on the source, they will be denied access when they try to access it.
This means that sensitive information could inadvertently be exposed to users in your
company, based on how the connection is set up.
Recommended best practice is to use a restricted access connection that enforces
permissions at the file level by checking the user's permissions before displaying the
information. Access to the drive still needs to be granted to the connecting user (ideally a
service account), but what is exposed to the user is not inheriting that account's
permissions.



Applying permissions in Google Drive

Before connecting a Google Drive, be sure to apply the correct visibility permissions in
the drive itself. As a best practice, connect to shared drives only so that private drives for individual users are
not exposed to the ES AI agents and so that access is not lost if a user leaves the
company.
Keep in mind and ensure the following:


The account you are using to connect the drive needs viewing permission at the
top-most, or parent, level before it can be connected. This is regardless of whether you
intend to connect a single file or a whole drive. You can narrow the selection to
folders during the connection process.
For shared drives, the connection does not interrogate the generic shared drive
settings to inform visibility. Specifically, it does not see the setting "Allow people
who aren't shared drive members to access files." Instead, it looks at the drive's
member-level roles and permissions at every level. If you want the drive to be visible
to your whole company, it needs to be directly shared with a user group or groups that
cover all employees.
For limited visibility connections, the permissions in the Google Drive should match
those you're applying in the connection.





Configuring resource-level permissions (RLP) before connecting to Google Drive

For connecting to Google Drive, it's recommended that you apply a resource-level permission
(RLP) connection type to ensure that shared links respect permissions set in Google Drive,
rather than relying only on the permissions of the connector's account.
To do so, the connecting user must have at least the read-only access admin role in the
drive. The read-only access admin role is required to connect to the Google Workspace
directory, which allows the integration to understand the hierarchy of users and groups and
match it to Zendesk users to enforce permissions.
As a best practice, use a dedicated service account for this and all connections and not an
individual user's account. A deactivated account would disconnect the Google Drive
connection, making those sources no longer be available to users.
You must be a Google Workspace administrator to grant an account the read-only access admin
role. Access must then be granted to that account at the shared drive level, not the
subfolder level. You can narrow the selection to particular folders later, as needed.
To grant the read-only access admin role to establish an RLP connection


In the Google Admin console, create a Custom Admin Role (see Create, edit, and delete custom admin roles in
Google Workspace documentation) with the following Admin API privileges:
Manage customer > Read customer
Manage customer > Read customer > Read customer branding settings
Manage customer > Read customer > Read customer contact info
Manage customer > Read customer > Read customer onboard settings
Manage customer > Read customer > Read customer profile settings
Manage customer > Read customer > Read customer support settings
Manage customer > Read customer > Read customer timezone settings
Groups > Read
Users > Read


Assign the role to the user you want to grant access (see Assign specific admin roles in Google Workspace
documentation). If you have created a dedicated service account for the connection,
select it as the user.



Now you can use the account with the read-only access admin role to connect to Google Drive.


Additional API calls used for permission enforcement

You can use these additional API calls for permission enforcement.









Endpoint
Docs
Purpose


https://developers.google.com/admin-sdk/directory/reference/rest/v1/domains/list
https://developers.google.com/admin-sdk/directory/reference/rest/v1/domains/list
List all domains


https://developers.google.com/admin-sdk/directory/reference/rest/v1/users/list
https://developers.google.com/admin-sdk/directory/reference/rest/v1/users/list
List all users


https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups/list
https://developers.google.com/admin-sdk/directory/reference/rest/v1/groups/list
List all groups


https://developers.google.com/admin-sdk/directory/reference/rest/v1/members/list
https://developers.google.com/admin-sdk/directory/reference/rest/v1/members/list
List group members


https://developers.google.com/drive/api/reference/rest/v3/permissions/list
https://developers.google.com/drive/api/reference/rest/v3/permissions/list
List shared drive permissions








Connecting to Google Drive for employee service AI agents

For connecting to Google Drive as a knowledge source, it's recommended that you apply a
resource-level permission (RLP) connection type to ensure that shared links respect
permissions set in Google Drive, rather than relying only on the permissions of the
connector's account.
To do so, ensure that you assign the read-only access admin role to the connecting user
(see Configuring resource-level permissions (RLP)
before connecting to Google Drive) before connecting to Google Drive. The previous
step is not required if you aren't using an RLP connection.
To connect to Google Drive using as a knowledge source

In Admin Center, click
AI agents in the sidebar, then select Sources.
Click Add source, then for Google Drive, click Connect.
Enter a unique connection name.
Select a user access type:

Restricted access: This connection enforces user permissions. This means that
when users ask questions, they see only information from the connected source that
they already have access to.

Open to everyone: This connection does not enforce user-level permissions for
the connected source. Users see all content available through that connected source.
If a user clicks on a source, but doesn’t have permission, access is denied.

See Understanding knowledge source permissions in employee
service AI agents.

Click Next.
Log in to the Google Workspace account you are using to connect, then follow the
on-screen prompts to authorize the connection.
In the list of Google Drive connections, select any drives, folders, and subfolders you
want to include in the connection, then click Done. The initial connection sync
begins. It may take some time to sync all content, depending on the volume. After the
initial sync, the integration captures file updates every 15 minutes. By default, files
in the Trash folder are indexed. When Google removes files from the Trash folder after
30 days, those sources are then removed from the sync.
At this point, you can add
the knowledge source to one or more AI agents by clicking Add to AI agent. Or,
you can wait to create and deploy an ES AI agent with this knowledge source at a later
time (see Creating, deploying and editing employee service AI
agents (EAP)).




{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/10861021627162",
"url": "https://support.zendesk.com/hc/en-us/articles/10861021627162",
"headline": "Connecting to Google Drive as a knowledge source for employee service AI agents (EAP)",
"description": "You can connect Google Drive as a knowledge source for employee service AI agents using single sign-on with OAuth 2.0 and configure resource-level permissions to control access based on Google Drive settings.",
"articleSection": "Employee service AI agents (EAP)",
"datePublished": "2026-06-03T17:53:37+00:00",
"dateModified": "2026-07-31T22:29:12.566891+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/10861021627162"