Google Drive Search finds files your account can access, including Google Docs, Sheets, and Slides. Member accounts uses your grant; Service account adds user, folder, and file-type restrictions. Both modes require your personal Drive connection.
Connect and search
- An admin adds Google Drive in Settings → Sources and chooses Member accounts, or configures the service source below.
- Each teammate selects Integrations → Google Drive → Connect and authorizes their account.
- Search a known file, read the result, and follow its source link.
Member mode has no organization folder, file-type, or user selection. Native Drive queries can narrow a search. For example, name contains 'Roadmap' and 'person@example.com' in owners finds candidate files by name and owner.
Readable content and limits
| File type | Read behavior |
|---|---|
| Google Docs and Slides | Text export |
| Google Sheets | Formatted values from up to 20 sheets, 1,000 rows, and 52 columns per sheet |
| Supported text and JSON | Direct content read |
| Text-bearing PDF and DOCX | Download and complete text extraction within the limits below |
| Other binary formats | Metadata and a source link |
PDF/DOCX reads require the member's download permission. Downloads are capped at 4 MiB and extracted text at 1 MiB. PDFs are limited to 100 pages. DOCX archives are limited to 10 MiB total expanded data and 4 MiB per entry. Password-protected, malformed, mismatched, or oversized files fail explicitly. Image-only scans need OCR; live Search does not perform it.
A file read also retrieves comments and replies through the reader's connection. It preserves authors, creation/update times, quoted file context, resolved state, resolve/reopen actions, and comment IDs. Deleted comments and replies are omitted.
Discussion reads cover up to three pages of 20 comments and their reply lists, capped at 120,000 characters and the provider response-size limit. Failures or reached limits add an incomplete-coverage notice without discarding readable file content. Follow returned document offsets for more windows; open Drive for remaining history.
Comments enrich a file read rather than forming a global search index. First find the file by name, owner, folder, or content. A phrase appearing only in comments cannot reliably discover every matching file.
Set up a central service account
-
Enable Google Drive API and Admin SDK API in Google Cloud. Enable Google Sheets API in the member OAuth project for Sheet reads. Create a service account and download its JSON key.
-
Authorize domain-wide delegation in Workspace Admin for the key's numeric client ID. The shared service-credential configuration declares:
https://www.googleapis.com/auth/drive.readonly https://www.googleapis.com/auth/admin.directory.user.readonly https://www.googleapis.com/auth/admin.directory.group.readonly https://www.googleapis.com/auth/admin.directory.domain.readonly -
In Settings → Sources → Google Drive, choose Service account → Add connection and add or select the credential.
-
Set Delegated administrator to an active Workspace administrator with Directory access. Optionally choose Users, folders, and a file type. Save and select this service source.
-
Each reader still connects Drive personally in Integrations.
The live verifier checks active Directory users and delegated Drive metadata. It does not run group/domain permission indexing; keep the scopes declared by the shared credential configuration when using that credential.
The folder picker uses the source credential; the paired folder-ID field is also available. Selected folders and accessible descendants define the boundary. Empty folders remove that restriction, not provider access checks.
Service-source access
Sim searches with your OAuth grant and verifies each candidate against current source visibility, folder ancestry, shared-drive identity, and file type. Your account must also read the file. Reads repeat the source checks.
With an explicit Users list, source verification tries up to six selected users through delegation. Without a list, it checks the connected member's active identity in the same Workspace customer and delegates to that user. For an external reader who cannot be delegated, it can use the verified source administrator and report incomplete coverage. It does not enumerate every employee's private Drive.
Personal files outside the configured boundary are excluded. Folder traversal, paging, and verification budgets are bounded. Google search freshness, export limits, and sharing settings still apply; link sharing alone does not authorize a result.
One service account for Drive, Gmail, and Calendar
One JSON key can serve all three sources. Enable Drive, Gmail, Calendar, and Admin SDK APIs; enable Sheets API in the member OAuth project for Sheet reads. Authorize the union of the shared credential's configured delegation scopes:
https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/gmail.readonly
https://www.googleapis.com/auth/calendar.events.readonly
https://www.googleapis.com/auth/calendar.readonly
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.domain.readonlyUse comma-separated values in Workspace Admin. Each source needs its own configuration, and each member connects each Google service separately. Delegation does not replace personal grants.
Meet transcripts and notes
Meet stores generated transcripts and smart notes as Google Docs in the organizer's Drive. Search them when shared with you, including documents retained beyond Meet's conference API window. For example:
fullText contains 'rollback' and mimeType = 'application/vnd.google-apps.document'Drive dates mean file modification time. Use Google Meet for recent transcripts with meeting dates and Google Calendar for scheduled events. Transcription or note-taking must have been enabled during the meeting; Search cannot reconstruct missing artifacts.
Troubleshooting
| Problem | Check |
|---|---|
| Delegation rejected | Check numeric client ID, key, approved scopes, and pending Workspace approval. |
| Directory identity unavailable | Check administrator access and active primary users in the same customer. |
| Readable file excluded | Check folders, Users, file type, and delegated source access. |
| Incomplete coverage | Narrow folders or query; missing files are not proof of absence. |
| PDF/DOCX text unavailable | Check download permission, size, password protection, format, and extractable text. For scans, provide a searchable copy or open the original. |
| Sheet read fails | Check Sheets API enablement in the project used by the member OAuth grant. |
Self-hosted member OAuth
Follow Google OAuth setup for the shared client, consent, full Drive member scopes, GOOGLE_CLIENT_ID, and GOOGLE_CLIENT_SECRET. Enable Google Drive API and Google Sheets API for these reads. Match NEXT_PUBLIC_APP_URL to the callback origin and register:
https://<your-sim-domain>/api/auth/oauth2/callback/google-driveThe personal grant includes drive and drive.file for workflow actions and is separate from service delegation. It remains required in service mode. One client can register each enabled Google callback. After changing client/scopes, update saved organization provider configuration and reconnect affected members.