Skip to content

Google BigQuery Prerequisites

Before configuring Google BigQuery:

  1. Create or use an existing service account or client credentials in your GCP environment.

    Tip

    It is highly recommended to use a service account for easier integration.

  2. Grant organization-level permissions.

    When connecting to SailPoint using an organization ID, the service account requires permissions at the Organization level to browse the resource hierarchy.

    1. Switch to Organization Context.

      1. Select the Project/Resource dropdown at the top of the GCP Console.
      2. Select your organization (e.g., sptechdev.com) instead of a specific project.

    2. Add a principal.

      1. In the left menu, go to IAM & Admin > IAM.
      2. Select Grant Access (or Add).
      3. In the New principals field, paste the full email address of your Service Account (e.g., name@project-id.iam.gserviceaccount.com).

    3. Select a browser role.

      1. Under Assign Roles, select Browser (roles/browser). This grants read-only access to browse the GCP resource hierarchy (organizations, folders, and projects).

    4. Select Save.

  3. Add Google Workspace SaaS as an Identity Security Cloud source where your deployment requires it, using the above configuration.

  4. If you are using a service account, verify the following APIs are enabled:
    1. Google BigQuery
    2. Cloud Assess
    3. DLP
    4. Cloud Resource Manager
    5. IAM
    6. Dataform
  5. For client credentials, verify the same scopes are enabled.

Adding an Identity Collector

Perform the following steps to add an identity collector:

  1. Go to Admin > Identity Collectors.
  2. Select Create New on the top right corner to open wizard.

In General details:

  • Type - Google Drive
  • Name - Logical name for the Identity Collector (Example: Google BigQuery IDC)

In Connection Details, select the Identity Security Cloud created Google Workspace SaaS source.

  1. User and Group Dynamic Fields Mappings are optional.
  2. Select Save.

Best Practice

Verify the Identity Collector associated to this application has completed an aggregation initiated from Data Access Security by navigating to Admin > Identity Collector > locate IC > Actions > Run Aggregation. This ensures all permissions will be mapped properly to Identity Security Cloud identities.

Google BigQuery Permissions

To enable Data Access Security to interact with Google Apps, you must:

  1. Enable the required APIs

    1. Google BigQuery
    2. Cloud Assest
    3. DLP
    4. Cloud Resource Manager

  2. For Client credentials, enabling the required Scopes is done when creating the credentials.

  3. For more details refer to the Google Workspace Prerequisites.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.