How to Connect Harmony Email to Google Workspace

Check Point Harmony Email & Collaboration provides API-based email security for Google Workspace, protecting Gmail and Google Drive from phishing, malware, and data loss without requiring MX record changes. This guide covers the complete integration process using the Check Point Infinity Portal.

Prerequisites

Before you begin, ensure you have:

• Check Point Infinity Portal account with Harmony Email & Collaboration license or trial
• Google Workspace Super Admin credentials for granting application permissions
• Active Google Workspace subscription (any edition)
• Google Admin Console access for policy verification
• List of domains configured in your Google Workspace

Understanding Protection Modes

Harmony Email offers two protection modes for Google Workspace:

Mode	Description	Email Processing Time	Best For
Monitor Only	Scans emails after delivery, logs threats	No delay	Initial testing, evaluation
Protect (Inline)	Scans emails before delivery, blocks threats	10 sec - 5 min	Production protection

Check Point recommends starting with Monitor mode to understand your threat landscape, then enabling Inline protection for active threat prevention.

Step 1: Access the Infinity Portal

1. Navigate to https://portal.checkpoint.com
2. Sign in with your Check Point account credentials
3. If you need an account, click Create Account and complete registration
4. Click the Menu icon (three horizontal lines) in the top left
5. Under Harmony, click Email & Collaboration

Step 2: Start Google Workspace Activation

1. On the Harmony Email dashboard, click Start Free Trial or Already have a contract
2. Click Let's Get Started on the welcome page
3. Locate Google Workspace (Gmail and Google Drive) and click Start

Step 3: Authorize Google Workspace Connection

1. Click Authorize to begin the Google OAuth flow
2. You'll be redirected to Google's sign-in page
3. Sign in with your Google Workspace Super Admin credentials
4. Review the permissions requested by Harmony Email & Collaboration:

Permission	Purpose
View and manage Gmail	Scan email content and take security actions
View and manage Drive files	Scan shared files for malware and sensitive data
View and manage groups	Apply policies to specific user groups
View organization units	Enumerate users and organizational structure

5. Click Allow to grant the requested permissions
6. Wait for the authorization to complete and redirect back to Infinity Portal

Step 4: Configure Protection Scope

After authorization, select which users to protect:

All Users

1. Select Protect all users in the organization
2. This includes all active Gmail accounts in your Google Workspace
3. Click Continue

Specific Groups or OUs

1. Select Protect specific groups or organizational units
2. Search for and select the Google Groups or OUs to protect
3. Click Add for each selection
4. Click Continue when finished

Tip: For large organizations, consider a phased rollout starting with IT and security teams before expanding to all users.

Step 5: Complete Initial Setup

1. Review your configuration summary
2. Click Activate to complete the initial setup
3. Harmony Email will begin synchronizing with Google Workspace

The system will now:

• Connect to your Google Workspace environment
• Enumerate protected users and groups
• Begin the initial learning and calibration process

Step 6: Configure Google Admin Console Settings

For Inline (Protect) mode, Harmony Email creates content compliance rules in Google Admin Console. Verify these are correctly configured:

Access Google Admin Console

1. Go to https://admin.google.com
2. Sign in with your Super Admin credentials
3. Navigate to Apps > Google Workspace > Gmail > Compliance

Verify Content Compliance Rules

Harmony Email creates the following rules automatically:

Rule Name	Purpose
[tenantname]_inline_ei	Inbound email scanning
[tenantname]_inline_eo	Outbound email scanning
[tenantname]_inline_ii	Internal email scanning

1. Locate the Harmony Email rules in the Content Compliance section
2. Verify each rule is Enabled
3. Confirm the rules are applied to the correct organizational units

Configure Inbound Gateway (If Required)

For Inline protection, you may need to configure an inbound gateway:

1. In Google Admin Console, go to Apps > Google Workspace > Gmail > Spam, Phishing and Malware
2. Under Inbound gateway, verify Check Point's IP ranges are whitelisted
3. This ensures scanned emails aren't flagged as suspicious

Step 7: Enable Protection Mode

After initial setup completes, enable your desired protection mode:

Enable Monitor Mode (Default)

1. In Harmony Email portal, go to Policy
2. Expand Gmail
3. Verify the default policy is set to Monitor Only
4. This mode logs threats without blocking emails

Enable Protect (Inline) Mode

1. Navigate to Policy in Harmony Email portal
2. Expand Gmail
3. Click the default threat protection policy
4. Change Policy Protection Mode to Prevent (Inline)
5. Click Save

When Inline mode is enabled, emails are:

1. Received by Google Workspace
2. Redirected to Harmony Email for scanning
3. Scanned for threats (typically 10 seconds to 5 minutes)
4. Returned to Google Workspace for delivery (if clean) or quarantined (if malicious)

Step 8: Configure Policy Rules

Customize protection with specific policy rules:

Create a New Policy Rule

1. Go to Policy > Add a New Policy Rule
2. Select Gmail under Choose SaaS
3. Select the security type:
   • Anti-Phishing: Detect phishing and BEC attacks
   • Anti-Malware: Block malicious attachments
   • DLP: Prevent data loss
4. Configure rule settings:
   • Direction: Inbound, Outbound, or Internal
   • Action: Detect, Prevent, or Quarantine
   • Scope: All users or specific groups
5. Click Save

Recommended Policy Configuration

Traffic Direction	Anti-Phishing	Anti-Malware	DLP
Inbound	Prevent	Prevent	Monitor
Outbound	Monitor	Prevent	Prevent
Internal	Monitor	Monitor	Monitor

Step 9: Configure Google Drive Protection

Harmony Email also protects files shared through Google Drive:

1. In Harmony Email portal, go to Policy
2. Expand Google Drive
3. Configure protection rules for:
   • File uploads: Scan files uploaded to Drive
   • File sharing: Monitor external sharing
   • DLP: Detect sensitive data in documents

Enable Drive Scanning

1. Click Add a New Policy Rule
2. Select Google Drive under Choose SaaS
3. Select Anti-Malware or DLP
4. Configure scanning options:
   • Scan on upload
   • Scan on share
   • Scan existing files (optional)
5. Click Save

Step 10: Verify the Connection

Confirm your integration is working correctly:

Check Connection Status

1. Go to Overview > SaaS Status
2. Verify Gmail shows Connected
3. Verify Google Drive shows Connected (if enabled)
4. Check the Last Sync timestamp

Review Protected Users

1. Navigate to Users & Groups
2. Verify the expected Google Workspace users are listed
3. Confirm user status shows Active

Test Email Scanning

1. Send a test email with an EICAR test file attachment
2. Check the Events section for detection
3. Verify the appropriate action was taken

Troubleshooting Common Issues

Authorization Fails

Symptoms: Google login fails or permissions aren't granted.

Solutions:

1. Ensure you're using Super Admin credentials
2. Check for browser extensions blocking pop-ups
3. Try an incognito/private browser window
4. Verify no Google Workspace restrictions prevent third-party app access

Content Compliance Rules Not Created

Symptoms: Inline protection doesn't work; rules missing in Google Admin.

Solutions:

1. Verify Super Admin permissions were granted correctly
2. Manually check and enable rules in Google Admin Console
3. Contact Check Point support for rule recreation

Emails Delayed Significantly

Symptoms: Emails take more than 5 minutes for Inline scanning.

Solutions:

1. Check Check Point service status for any outages
2. Review email volume; high volume may cause delays
3. Consider using Monitor mode for less critical traffic
4. Contact support if delays exceed SLA

Drive Files Not Scanning

Symptoms: Google Drive protection shows connected but files aren't scanned.

Solutions:

1. Verify Drive permissions were granted during authorization
2. Check policy rules are configured for Google Drive
3. Ensure file size is under the scanning limit (10 MB)
4. Review user is in a protected group

Manual Integration (Advanced)

If automatic integration isn't suitable, you can manually configure Google Workspace:

Create Content Compliance Rules Manually

1. In Google Admin Console, go to Apps > Google Workspace > Gmail > Compliance
2. Click Add another rule under Content Compliance
3. Configure rule for inbound traffic:
   • Name: checkpoint_inline_inbound
   • Messages to affect: Inbound
   • Route: Check Point scanning server
4. Repeat for outbound and internal traffic
5. Reference the Manual Integration Guide for specific settings

Next Steps

After successfully connecting to Google Workspace:

1. Fine-tune policies: Adjust detection sensitivity based on initial findings
2. Configure DLP: Enable data loss prevention for sensitive information
3. Set up alerts: Create notifications for high-severity threats
4. Enable quarantine management: Configure end-user quarantine access
5. Review dashboards: Monitor threat trends and security metrics

Additional Resources

• Harmony Email & Collaboration Admin Guide
• Google Workspace Activation Documentation
• Google Workspace Marketplace - Harmony Email

---

Need expert help with email security? Inventive HQ offers comprehensive Check Point deployment and management services. Contact us for a free consultation.