Skip to main content
Flying Cloud Publishes Executive Briefing on Data Defensibility in the Face of Global Data Sovereignty Regulation.  Let’s Talk

CrowsNest Deployment

Connect CrowsNest Through Provider-Authorized Cloud APIs

CrowsNest is a fully hosted SaaS platform for organizational Google Workspace and Microsoft 365 environments. An authorized administrator approves the documented provider permissions, tests the connection and selects the users, sources and historical range included in analysis.

No Endpoint Rollout Customer-Approved Permissions Selected Monitoring Scope

Connect Google Workspace

  1. Create or select a Google service account.
  2. Configure domain-wide delegation with the required read-only directory and Gmail scopes.
  3. Enter the service-account credentials and authorized administrator account in CrowsNest.
  4. Test the connection, discover users and choose the users and historical scope to analyze.
Default permissions: Gmail read-only plus read-only directory user and group access. Gmail send permission is requested only when the Agent Email Proxy reply capability is enabled.

Connect Microsoft 365

  1. Register an application in Microsoft Entra ID/Azure.
  2. Approve the required app-only Microsoft Graph permissions.
  3. Enter the tenant ID, client ID and client secret in CrowsNest.
  4. Test consent, discover users and select mailboxes, repositories and historical scope.
Default permissions: Mail.Read and User.Read.All for email discovery and analysis. Mail.Send is optional and used only for authorized Agent Email Proxy replies. SharePoint and OneDrive scanning require tenant-wide Files.Read.All and Sites.Read.All.

Administrator requirement: Google Workspace connection requires an administrator who can configure domain-wide delegation. Microsoft 365 connection requires an administrator who can register an Entra ID application and grant the documented application permissions.

Supported Source Deployment

Cloud-drive and SaaS connectors are enabled per tenant. Administrators can select supported sources, active users, retention settings and historical scanning parameters.

Customer responsibilities

  • Authorize the appropriate provider application or service account.
  • Approve the documented permission scopes.
  • Select the users, repositories and historical range to analyze.
  • Review findings and adjust tenant-specific policies and tuning.
  • Renew or replace connector credentials when provider credentials expire.

Flying Cloud responsibilities

  • Host and maintain the CrowsNest SaaS platform.
  • Operate application releases and database migrations.
  • Run ingestion, scanning, retention and monitoring services.
  • Provide the supported settings and investigation experience.

Connector Cadence

Source Processing model
Microsoft 365 mail Near-real-time webhook processing with reconciliation
Gmail Tenant-configurable scheduled polling
SharePoint / OneDrive Change-driven and scheduled scanning
Google Drive / Dropbox Scheduled cloud-repository scanning
Salesforce / HubSpot / Bloomerang / Teams Scheduled SaaS record scanning

Time to First Findings

Technical connection work begins after the customer authorizes the required Google Workspace or Microsoft 365 permissions. Flying Cloud does not publish a universal deployment-time promise because internal approval, monitored-user scope, historical range, source volume and provider API behavior can materially change elapsed time. Define the expected authorization and first-scan milestones in the evaluation plan before the 14-day clock becomes meaningful.

Start 14-Day Evaluation
Request a Guided POC
Review supported integrations