Restrict access via GlobalProtect to permit access to only a specific Google Drive Account/Folder

[joe.jorgensen]

I’m looking to enable access via GlobalProtect to a specific Google Drive account/folder, rather than granting access to all of Google Drive. I’ve encountered mixed guidance on whether this is feasible—ranging from assertions that it cannot be done at all, to suggestions that it may be possible through a combination of SSL decryption, URL filtering, and custom URL categories to inspect and control HTTPS traffic.

Given the strict nature of our company DLP policies, any exception permitting Google Drive access must include fine-grained controls that restrict access strictly to only what is required. My goal is to determine whether this level of granularity can realistically be enforced using GlobalProtect and the associated Palo Alto security features.

Has anyone tackled a similar use case or successfully implemented this type of control? Any insights, best practices, or lessons learned would be greatly appreciated. Thank you in advance for your guidance!

GlobalProtect  

[JayGolf]

Hi @joe.jorgensen ,

Hope you are well. I would first start off by saying this would be a hard pitch.

You may be able to get some control around approved Google accounts or domains using SSL decryption and HTTP header insertion for Google. For example, you could allow users to sign in only with accounts from yourcompany.com, while blocking personal gmail accounts or accounts from other domains. I have not personally implemented this myself. 

As far as the file/folder restriction, I would lean on Google Drive / Google Workspace for that level of control. That is less firewall/VPN territory and more a matter of granular SaaS permissions.