Google Workspace - Email Quarantine

CanIPhish can integrate with Google Workspace through the use of a Service Account to quarantine emails reported through CanIPhish's Gmail Report Email Add-in. Implementing this functionality significantly improves the email report experience, as reporters don't need to manually move emails to the trash or spam folders after a report takes place.

Additionally, you as the administrator gain powerful capabilities over deciding what type of emails should be quarantined, with the ability to report actual spam/phishing emails to Google, or even recover emails accidentally reported as spam/phishing,

To get started, please follow the steps outlined below.

Note: For Email Quarantine functionality to work, you must be using CanIPhish's Gmail Report Email Add-in. Emails reported through CanIPhish's Report Email Forwarding Address cannot be quarantined.

Note: CanIPhish uses one service account for your workspace. If direct email injection is already connected to Google Workspace, this setup shows the same client ID, and you give its existing domain-wide delegation entry both scopes. See Already using direct email injection?

Table of Contents

• Step 1. Assign Permissions To The CanIPhish Service Account
• Step 2. Test The Connection
• Frequently Asked Questions

Step 1. Assign Permissions To The CanIPhish Service Account

1.1. Log in to your CanIPhish account, open the Phish Triage page and click Phish Triage Settings.

1.2. Go to the Quarantine tab and select Google Workspace:

1.3. Set up Google Workspace connectivity opens. Under Grant access, it shows the client ID of the service account CanIPhish manages for your workspace. Copy it with the copy button: you'll need it in Google Admin.

Already using direct email injection?

If direct email injection is connected to Google Workspace, the dialog shows the client ID it already uses, and says Direct email injection is set up with this client ID too. That client ID already has a domain-wide delegation entry, with the gmail.insert scope. In steps 1.7 to 1.9, edit that entry so it lists both scopes, rather than adding a new one. The copy button under the message copies both scopes.

1.4. Open a new browser tab and log in to the Google Admin Console.

1.5. Go to Security > Access and data control > API Controls:

1.6. Click MANAGE DOMAIN WIDE DELEGATION at the bottom of the page:

1.7. Click Add new next to API clients:

Note: If direct email injection already uses this client ID, it's already in the API clients list. Find its row and click Edit instead. Clicking Add new and ticking Overwrite existing client ID also works, as long as you enter both scopes in step 1.9.

1.8. In the Client ID field, enter the client ID you copied in step 1.3.

1.9. In the OAuth scopes field, enter the following scope and click AUTHORIZE:

https://www.googleapis.com/auth/gmail.modify

If direct email injection uses the same client ID, enter both scopes instead, so direct email injection keeps working:

https://www.googleapis.com/auth/gmail.insert,https://www.googleapis.com/auth/gmail.modify

Step 2. Test The Connection

2.1. Go back to the CanIPhish browser tab.

2.2. Under Test the connection, enter the address of a Google Workspace mailbox and click Test connection. CanIPhish checks that it can search that mailbox with the permissions it needs, and changes nothing. When it says Connection works, close the dialog.

Note: Google can take a while to apply new delegation, usually a few minutes. If the test fails straight after you authorise, wait and test again.

2.3. The tab now shows Connected. Choose your Quarantine rules and click Save settings to finish. For what the rules do, see the Frequently Asked Questions below.

You're all done!

Frequently Asked Questions

I'm quarantining emails that require analysis, but I want those marked as Not Phish and Not Spam to be restored.

You're in luck! If you've configured CanIPhish to quarantine emails that have an attribution of "Analysis Required", and then later mark those emails as "Not Phish" and "Not Spam", CanIPhish has built-in functionality to restore these emails, so long as those attribution statuses aren't marked for quarantining. For an example of the recommended configuration, please refer to the screenshot below:

Why does CanIPhish require the requested Gmail modify permission?

The https://www.googleapis.com/auth/gmail.modify permission provides CanIPhish with the least amount of privileges to perform email quarantining. With the gmail.modify permission CanIPhish can move reported emails to spam folders, delete reported emails and place them in the trash folder, and additionally restore reported emails if they are marked as Not Spam or Not Phish.

If emails that require analysis are set to be quarantined, does quarantining occur immediately after the report is received?

Near immediately! If your quarantine configuration dictates that emails that require analysis are to be quarantined, then they will be quarantined within 5-40 seconds of the user performing the initial report.

Why does direct email injection show the same client ID?

CanIPhish manages one service account per workspace for Google Workspace. Whichever feature you connect first, direct email injection or email quarantine, sets it up, and the other uses the same one. Its domain-wide delegation entry lists the scopes for the features you use: gmail.insert for direct email injection and gmail.modify for email quarantine. Workspaces that got two service accounts before 25 October 2026 keep both, each with its own client ID and entry.