> For the complete documentation index, see [llms.txt](https://oten.gitbook.io/kms-support/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oten.gitbook.io/kms-support/user-guide/publish-your-docs-2/gmail-provisioning-setup.md).

# Gmail provisioning setup

### \* Important note: 

* Due to the specific mechanism of Google CSE for this Gmail feature, any setup or configuration changes may take **up to 24 hours to take effect.**
* Referral link: <https://knowledge.workspace.google.com/admin/support/troubleshooting/how-changes-propagate-to-google-services?visit_id=639099359861759319-1195085483&rd=1>

### I. Set up KMS KACLS Service for Google Workspace

* Emails utilizing the wrap/unwrap mechanism must ensure they share the same Key service (KMS KACLS Service URL) in order to successfully send and receive emails to one another.

{% embed url="<https://app.supademo.com/demo/cmnpnmal602hfzz0j8bcmw4bq?utm_source=link>" %}

### II. Enable Gmail CSE

* Admins must **enable Gmail CSE** to use this feature

{% embed url="<https://app.supademo.com/demo/cmnsoz4a33s24cr4jied1auun?utm_source=link>" %}

### III. Get service account from Admin Google Cloud

**Note**: you must have role **Organization Policy Administrator** (roles/orgpolicy.policyAdmin) to get Service account key.

{% embed url="<https://app.supademo.com/demo/cmnpownh702g5ye0jlvkczdey?utm_source=link>" %}

### IV. Grant permissions to use Service Account in KMS

* For **Client ID:** this information can be retrieved from the newly created Service Account or the downloaded JSON file
* For **OAuth scopes:** [**https://www.googleapis.com/auth/gmail.settings.basic**](https://www.googleapis.com/auth/gmail.settings.basic)

{% embed url="<https://app.supademo.com/demo/cmnsj4hfn3h0gcr4jlmngibtg?utm_source=link>" %}

### V. Get credentials at KMS system

* Admins must upload the retrieved Service Account (JSON) to the KMS, which will then generate a CA certificate required for further configuration in the Google Admin Console.

{% embed url="<https://app.supademo.com/demo/cmnpq2tjv02qizz0jhy80at4a?utm_source=link>" %}

### V. Setup provisioning job for email

**Note:** To ensure a successful KACLS connection, Admins must verify that all emails share the same Key Service access. Furthermore, the Key Service in use must match the configuration in the Google Admin Console.

{% embed url="<https://app.supademo.com/demo/cmnprw5hr02zkwo0jr8ua2xlt?utm_source=link>" %}