Google app ecosystem lists the apps that are installed in the domain using an OAuth 2.0 token. In previous releases, Netskope identified these apps and described them using a CCI score, scope used, and app type. From release 48 on wards, users can create policies to revoke apps based on specific criteria. This feature allows creation of policies on third-party apps displayed in Google App Ecosystem. Policies may be based on an app ID, scopes used, CCI score, and more. Users may also create a list of apps that may be included or excluded from a policy trigger. App revocation can be done for all or selected users who have installed the app.
This section of the API Data Protection Policy page specifies the Google apps and plugins that can trigger a policy violation.
Note
This policy option is available for Google Drive application only.
- Select one of the following options:
- Connected Apps/Plugins: With this option, you can select specific Google apps and plugins. You can search by App ID and name.
Note
An app name can have multiple app IDs. If you create a policy for a specific app name, select all the instances of the app name. If not selected, notification for such app IDs will not trigger the policy to revoke.
- Connected App/Plugins Profiles: With this option you can select a profile comprising a custom list of Google apps and plugins. To create a connected app/plugin profile:
- Go to Policies > Profiles > Connected App/Plugin.
- Click New Connected App/Plugin Profile.
- In the Add Connected App/Plugin Profile page, click Select File.
Upload the .csv file comprising of the list of connected apps/plugins and IDs. The format of the .csv file should be:
- connectedApp1,ID
- connectedApp2,ID
- connectedApp3,ID
- Click Next, enter the name for this profile, and click Save Connected App/Plugin Profile.
You can exclude certain connected apps/plugins from triggering a policy. Click +Exlcude Connected Apps/Plugins and select the connected apps/plugins from the list and click SAVE.
- By Scope and CCL: You have two options here; Scope and CCL:
- Scopes: With this option, you can select a specific scope for each app/plugin. You have the option to select multiple scopes.
- CCLs: With this option, you can select apps/plugins based on their Cloud Confidence Index Level (CCL). The available CCLs are excellent, high, medium, low, poor, and unknown.
Note
CCL scores apply to Google apps only. Google plugins do not support CCL score.
You can exclude certain connected apps/plugins from triggering a policy. Click +Exclude Connected Apps/Plugins or +Exclude Connected App/Plugin Profiles and select the connected apps/plugins (profiles) from the list and click SAVE.
- All Connected Apps/Plugins: With this option, all connected apps/plugins are selected.
You can exclude certain connected apps/plugins (profiles) from triggering a policy. Click +Exclude Connected Apps/Plugins or +Exclude Connected App/Plugin Profiles and select the connected apps/plugins (profiles) from the list and click SAVE.
Note
If you select Connected App/Plugins Profiles, By Scope and CCL, or All Connected Apps/Plugins, additional options are available to exclude connected apps/plugins and profiles from blocklisting.
- Connected Apps/Plugins: With this option, you can select specific Google apps and plugins. You can search by App ID and name.
- When finished, click Next, and then go to the topic in this guide that matches the section you’re configuring on the New API Data Protection Policy page.