Skip to content

Commit 53c7346

Browse files
Maddy-CloudflareMaddy-Cloudflare
authored
[Email Security] Gmail BCC setup guide (#18153)
* [Email Security] Gmail BCC setup guide * Fix links and add more info * Adding H3s * Adding numbers to H3s
1 parent 969ed00 commit 53c7346

File tree

6 files changed

+166
-0
lines changed

6 files changed

+166
-0
lines changed

‎src/assets/images/email-security/deployment/api-setup/gmail-bcc-deployment.png‎

29.5 KB
Loading

‎src/content/docs/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/connect-domains.mdx‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
title: Connect your domains
3+
pcx_content_type: how-to
4+
sidebar:
5+
order: 3
6+
---
7+
8+
import { GlossaryTooltip } from "~/components"
9+
10+
On the **Set up Email Security** page:
11+
12+
1. **Connect domains**: Select at least one domain. Then, select **Continue**.
13+
2. (**Optional**) **Add manual domains**: Select **Add domain name** to manually enter additional domains. Then, select **Continue**.
14+
3. (**Optional**) **Adjust hop count**: Enter the number of <GlossaryTooltip term="Hops">hops</GlossaryTooltip>. Then, select **Continue**.
15+
4. (**Optional**, select **Skip for now** to skip this step) **Move messages**: Refer to [Auto-moves](/cloudflare-one/email-security/auto-moves/) to configure auto-moves. Then, select **Continue**.
16+
5. **Configure service address with your third party email provider**: Copy and paste the service address into your third-party email provider to allow BCC/Journaling: `<account tag>@CF-emailsecurity.com`.
17+
6. **Review details**: Review your connected domains. Then, select **Go to domains.**
18+
19+
Your domains are now added successfully.
20+
21+
On the **Domains** page, select the three dots > **View integration**. The dashboard will display your [domain information](/cloudflare-one/email-security/reference/domain-information/).
22+
23+
Under **Source**, the dashboard will display **Google integration**, along with the **Integration name**.
24+
25+
## Add additional domains
26+
27+
To add additional domains:
28+
29+
1. Go to **Settings**.
30+
2. Select **Connect an integration** > **BCC/Journaling** > **Integrate with Google** > **Authorize**.
31+
3. **Connect domains**: Select the domains you want to add, then select **Next**.
32+
4. (Optional) Select **Add manual domains**: Enter additional domains manually, then select **Next**.
33+
5. (Optional) Select **Adjust hop count**: Enter the number of <GlossaryTooltip term="Hops">hops</GlossaryTooltip>.
34+
6. **Review details**: Review your selected domains, then use the following email to configure the service address with your third-party email provider:
35+
```txt
36+
<account tag>@CF-emailsecurity.com
37+
```
38+
7. Select **Save**.

‎src/content/docs/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/enable-auto-moves.mdx‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: Enable auto-moves
3+
pcx_content_type: how-to
4+
sidebar:
5+
order: 4
6+
---
7+
8+
If you do not have an integration:
9+
10+
1. Go to **Settings** > **Integrated domains** > Select **View**.
11+
2. Select the three dots > Select **Associate an integration**.
12+
3. Select **Connect an integration**. You will then be redirected to a page where you will [enable your Microsoft integration](/cloudflare-one/email-security/setup/post-delivery-deployment/api/office365-api/#enable-microsoft-integration).
13+
4. Once you have enabled your Microsoft integration, select **Complete Email Security set up**.

‎src/content/docs/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/enable-gmail-integration.mdx‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
title: Enable Gmail BCC integration
3+
pcx_content_type: how-to
4+
sidebar:
5+
order: 2
6+
---
7+
8+
To enable Gmail BCC integration:
9+
10+
1. Log in to [Zero Trust](https://one.dash.cloudflare.com/).
11+
2. Select **Zero Trust** > **Settings**.
12+
3. Select **SaaS Integrations**.
13+
4. Select **Add integration** > **Google Workspace**.
14+
5. Select **Select Integration**.
15+
16+
## Create an integration
17+
18+
Name your integration, then select **Next**.
19+
20+
### 1. Create a Service Account in your GCP Project
21+
22+
1. Once you have named your integration, select **Next**.
23+
2. On the [Google Cloud Console](https://console.cloud.google.com/welcome/new), go to the sidebar, select **APIs & Services**, then select **Credentials**.
24+
3. Select **CREATE CREDENTIALS** > **Service account**.
25+
4. Fill in the details to create a service account:
26+
- **Service account name**: Enter `Message Retraction Service Account`.
27+
- **Service account ID**: Enter `message-retraction-service-acc`.
28+
- **Service account description**: Enter `Email Security Message Retraction`.
29+
- Select **CREATE AND CONTINUE**.
30+
5. In **Grant this service account access to project**, select **Select a role** > Choose **Owner**. Select **CONTINUE**, then select **DONE**.
31+
6. Go back to **Credentials** on the sidebar, and select your service account under **Service Accounts**. In **Details**, take note of the **Unique ID**.
32+
7. Select **Advanced settings** > **VIEW GOOGLE WORKSPACE ADMIN CONSOLE**, then enter your password. This will redirect you to the Google admin portal.
33+
8. On the sidebar, select **Security** > **Access and data control** > **API controls** > Select **MANAGE DOMAIN WIDE DELEGATION**.
34+
9. Select **Add new** > Add a new client ID:
35+
- **Client ID**: Enter the **Unique ID** you took note of in step 5.
36+
- **OAuth scopes**: Enter the following URLs:
37+
38+
```txt
39+
https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly, https://www.googleapis.com/auth/admin.directory.user.alias.readonly, https://www.googleapis.com/auth/gmail.labels, https://mail.google.com/
40+
```
41+
- Select **AUTHORIZE**.
42+
43+
### 2. Create a JSON Key for your Service Account
44+
45+
On the [Google Cloud Console](https://console.cloud.google.com/welcome/new), select **Service Accounts** on the sidebar:
46+
- Select the three dots, then:
47+
- Select **Manage keys**.
48+
- Select **ADD KEY** > **Create new key**.
49+
- Select **JSON** > Select **CREATE**. This downloads a `.json` file which you will use at a later stage.
50+
51+
### 3. Upload JSON Key
52+
53+
On the [Zero Trust dashboard](https://one.dash.cloudflare.com/), upload the `.json` file downloaded on step 3.
54+
55+
### 4. Enable Necessary Google Workspace APIs in GCP
56+
57+
Enable the following APIs on the Google Cloud Console:
58+
- [Enable Google Calendar API](https://console.cloud.google.com/apis/library/calendar-json.googleapis.com?project=winter-surf-439414-h1)
59+
- [Enable Google Drive API](https://console.cloud.google.com/apis/library/drive.googleapis.com?project=winter-surf-439414-h1)
60+
- [Enable Google Admin SDK API](https://console.cloud.google.com/apis/library/admin.googleapis.com?project=winter-surf-439414-h1)
61+
- [Enable Gmail API](https://console.cloud.google.com/apis/library/gmail.googleapis.com?project=winter-surf-439414-h1)
62+
- [Enable Google Service Usage API](https://console.cloud.google.com/apis/library/serviceusage.googleapis.com?project=winter-surf-439414-h1)
63+
64+
### 5. Log in to Google Workspace Admin Console
65+
66+
Log in to Google Workspace Admin Console: Enter your password and log in to the Google Workspace Admin Console.
67+
68+
### 6. Create a Domain-Wide Delegation API Client
69+
70+
1. Copy the **Client ID** and **Scopes** displayed on the Zero Trust dashboard.
71+
2. On Google Admin, go to **Security** > **Access and data control** > **API controls**.
72+
3. Select **MANAGE DOMAIN WIDE DELEGATION** > **Add new**.
73+
4. Use the Client ID and copy the scopes to create a new API client. Refer to [Delegate domain-wide authority to your service account](https://cloud.google.com/chronicle/docs/soar/marketplace-integrations/google-alert-center?_gl=1*skktsb*_ga*MTMxODg5NDExMy4xNzI5NjA1MzYy*_ga_WH2QY8WWF5*MTcyOTc3MDg2Ny40LjEuMTcyOTc3MDg5OC4yOS4wLjA.#delegate_domain-wide_authority_to_your_service_account). Then, select **Next**.
74+
75+
### 7. Confirm Workspace Administrator Email
76+
77+
Enter the email associated with the Google Workspace Administrator account. Your email must match the email associated with your Google Workspace account, or else your integration will not work.
78+
79+
### 8. Create integration
80+
81+
1. Select **Create integration**.
82+
2. Once you created your integration, you will be redirected to the **Review details** page, where you will be able to review **Integration details**.
83+
3. Review your details, then select **Complete Email Security set up** > **Continue to Email Security**.
84+
85+
## Next steps
86+
87+
Now that you have created an integration, you will need to [connect your domains](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/connect-domains/) for Email Security to start scanning your inbox.

‎src/content/docs/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/gmail-bcc-setup.mdx‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
title: Overview
3+
pcx_content_type: overview
4+
sidebar:
5+
order: 1
6+
---
7+
8+
9+
For customers using Gmail as their email provider, setting up Email Security is quick and easy.
10+
11+
You will need to [enable Gmail BCC on the Zero Trust dashboard](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/enable-gmail-integration/), [create an integration](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/enable-gmail-integration/), and [connect your domain(s)](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/connect-domains/). You can choose to [add additional domains](/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/connect-domains/) at a later stage.
12+
13+
Once you set up Gmail BCC integration, Email Security will receive a copy of your email messages. The following email flow shows how this works:
14+
15+
![Gmail BCC deployment flow](~/assets/images/email-security/deployment/api-setup/gmail-bcc-deployment.png)

‎src/content/docs/cloudflare-one/email-security/setup/post-delivery-deployment/bcc-journaling/bcc-setup/gmail-bcc-setup/index.mdx‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
title: Gmail BCC setup
3+
pcx_content_type: navigation
4+
sidebar:
5+
order: 1
6+
group:
7+
hideIndex: true
8+
---
9+
10+
import { DirectoryListing } from "~/components"
11+
12+
13+
<DirectoryListing />

0 commit comments

Comments
 (0)