Google Drive supports Member accounts and Service account. Each reader connects their own Drive account in Integrations. Google Docs, Sheets, and Slides are discovered through Drive rather than separate Search sources.
Member accounts
An admin adds Google Drive under Settings → Sources, chooses Member accounts, and saves. Members select Integrations → Google Drive → Connect and authorize their own accounts.
Search calls Drive with that member's grant. No organization folder, file-type, or user selection applies in member mode. Provider permissions and native Drive search determine what can match.
Set up a central service account
- Enable Google Drive API and Admin SDK API in Google Cloud. Create a service account and download its JSON key.
- Authorize domain-wide delegation in Google Workspace Admin for the key's numeric client ID. The shared Drive service-credential configuration declares these scopes:
https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.domain.readonlyThe live verifier checks active users through Directory and reads file metadata through delegated Drive tokens. It does not run the legacy group/domain ACL indexing process. Retain the configured credential scopes when using the shared connector or the legacy backend.
- In Settings → Sources → Google Drive, choose Service account, then Add connection. Add or select the Google service credential.
- Set Delegated administrator to an active Workspace administrator with the required Directory access. Optionally choose Users, folders, and a file type. Save and select the connection as Drive's service source.
- Every reader connects their own Google Drive account under Integrations.
The folder picker uses the source credential; the paired folder-ID field remains available. Selected folders and accessible descendants define the boundary. Leaving folders empty removes that folder restriction, but never removes provider access checks.
How filtering works
Sim searches with the member's OAuth token. In service mode, it narrows retrieval to the source's folder scope where possible, then verifies each candidate's current source-side visibility, folder ancestry, shared-drive identity, and file type as applicable. The member must also be able to read the file.
For an explicit source Users list, verification tries up to six selected users through domain-wide delegation. With no list, it verifies the connected member's active identity in the same Workspace customer and delegates to that user. If an external connected reader cannot be delegated in that customer, source verification can use the verified source administrator and report incomplete coverage. It does not enumerate every employee's private Drive.
A member's personal file outside the source boundary is excluded even when their token can read it. Folder traversal, provider pagination, and verification budgets are bounded. Reads resolve current grants and repeat the source checks.
Content and limits
Drive search discovers matching files. Reads export Google Docs and Slides as text, read supported text/JSON files directly, and read formatted Sheet values from up to 20 sheets, 1,000 rows, and 52 columns per sheet. Other file types return metadata and a source link. Live Search does not run background attachment parsing or OCR.
Reading a file also retrieves its comments and replies using the reader's existing Drive connection. Discussion text includes author names, creation and update times, quoted file context, resolved state, and resolve/reopen actions. Deleted comments and replies are omitted. The source file link and comment identifiers let you locate the discussion in Drive.
Comments enrich the file read; they are not a separate global search index. Locate the file by its name, owner, folder, or content, then read it for discussion context. For example, name contains 'Roadmap' and 'person@example.com' in owners finds candidate files. Do not assume a phrase that appears only in a comment will discover every matching file.
Discussion reads follow up to three pages of 20 comments, including each comment's full reply list, with a 120,000-character discussion limit and the provider response-size limit. A document begins with an incomplete-coverage notice if comments cannot be retrieved or a limit is reached. Available file content is preserved; open the source for the remaining discussion. Continue through the returned document offsets when the available content spans more than one read window.
Google's own search freshness, export limits, and access settings determine availability. Link sharing alone does not make a file an unrestricted Search result; the current member and configured service boundary must authorize it.
One service account for Drive, Gmail, and Calendar
One JSON key can be used for all three service sources. Enable Drive, Gmail, Calendar, and Admin SDK APIs, then authorize the union of the configured scopes:
https://www.googleapis.com/auth/drive.readonly
https://www.googleapis.com/auth/gmail.readonly
https://www.googleapis.com/auth/calendar.events.readonly
https://www.googleapis.com/auth/calendar.readonly
https://www.googleapis.com/auth/admin.directory.user.readonly
https://www.googleapis.com/auth/admin.directory.group.readonly
https://www.googleapis.com/auth/admin.directory.domain.readonlyUse comma-separated values in the Workspace delegation form. Each source still needs its own configuration, and each member still connects each Google service separately. Delegation does not replace those personal grants.
Troubleshooting
| Problem | Next step |
|---|---|
| Delegation is rejected | Verify the numeric client ID, JSON key, approved scopes, and any pending Workspace approval. |
| Directory identity is unavailable | Check the administrator's access and that selected primary users are active in the same Workspace customer. |
| Member can open a file but Search excludes it | Check source folders, selected users, file type, and whether the delegated source identity can read the file. |
| Coverage is incomplete | Narrow the folder or query scope; bounded user and folder verification does not imply that missing files are absent. |
| File cannot be read as text | Open the original file. Live Search does not run the knowledge-base attachment parser or OCR retry flow. |
Self-hosted OAuth configuration
Configure the deployment’s Google OAuth client for every member’s personal connection, including members using a service-account source. This is separate from domain-wide delegation.
- In Google Cloud Console, select your project and enable Google Drive API under APIs & Services → Library.
- Open Google Auth platform → Branding and configure the app name and contact details. Under Audience, choose Internal for your Google Workspace organization only, or External for other users, adding test users while testing. Review Data Access → Add or remove scopes using the current Sim scopes below. See Google's consent guidance.
- Open Google Auth platform → Clients → Create client, choose Web application, and add this URI under Authorized redirect URIs. Add it to the existing Google client if your instance already uses one.
https://<your-sim-domain>/api/auth/oauth2/callback/google-driveOne OAuth client can register callbacks for all three Google services. Use your exact Sim origin and add only the callbacks for services you enable.
Save the client ID and secret as GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET. Set NEXT_PUBLIC_APP_URL to the same Sim origin used in the callback, then restart Sim. See Integrations & OAuth. If you change an existing deployment's OAuth client or scopes, an organization admin updates the provider configuration and affected teammates reconnect.
The current Sim Drive OAuth connection uses these scopes:
openid
https://www.googleapis.com/auth/userinfo.email
https://www.googleapis.com/auth/userinfo.profile
https://www.googleapis.com/auth/drive
https://www.googleapis.com/auth/drive.fileThe personal OAuth connection also supports workflow actions, so its declared scopes can be broader than Search’s read-only requests. The service credential uses the separate delegation scopes above.
Google Meet transcripts and notes
Meet saves generated transcripts and smart notes as Google Docs in the organizer's Drive. Connect Drive to search and read these documents when you have access, including older artifacts that remain after Meet's conference API retention window. For example, use fullText contains 'rollback' and mimeType = 'application/vnd.google-apps.document'.
Drive date filters use the file's modification time, not the meeting's start. Use Google Meet for recent conference transcripts with meeting dates and Google Calendar for scheduled events. Transcription or note-taking must have been enabled during the meeting; Search cannot reconstruct a missing artifact.