SaaS tools and SaaS warehouses have no environment of yours to run a scanner in, so TigerGate reads them through each provider’s API with a read-only credential you provide. The credential is stored encrypted. By default TigerGate reads full content, and later runs read only what the provider’s change feed reports as new or changed.

​
Connect a source

1

Add the connection

Go to Integrations → Cloud Providers and pick the provider under SaaS data sources or Databases and warehouses. You can also start from DSPM → Deployments → Add deployment and choose SaaS application or SaaS warehouse; you return to Deployments after saving.
2

Enter the credential

Fill in the fields listed for the provider below, save, and test the connection. A weekly inventory schedule starts on its own.
3

Turn on content scanning

In DSPM → Deployments, open the connection and go to Configuration:
  • Under Scan depth and content access, choose Read content in the scope below. TigerGate then verifies access by reading through the connection’s credential. The result shows as verified, or failed with the reason; use Verify now after fixing it.
  • Under What to read, tick Scan every data store, or list stores with Include by name and Include by tag. Exclude by name wins over inclusions. With nothing selected, nothing is read.
  • Adjust How often and Hosted scanning if needed (see Scheduling).
Save the settings.
4

Run it

Select Run now, or wait for the schedule. Progress, the last error with its fix, and throttling appear on the connection’s Overview.
Hosts are limited to each provider’s own domains: *.atlassian.net or *.jira.com, *.zendesk.com, *.service-now.com, *.salesforce.com, *.force.com or *.salesforce.mil, and the Databricks workspace domains. A vanity domain is refused when you save.

​
Microsoft 365

SharePointOneDrive
One datastore perDocument library of each siteUser’s OneDrive
ReadsFilesFiles
Graph application permissionsSites.Read.All, Files.Read.AllFiles.Read.All, User.Read.All
FieldsDirectory (tenant) ID, Application (client) ID, Client secretThe same
  1. In the Microsoft Entra admin center, create an app registration. Note the Directory (tenant) ID and the Application (client) ID.
  2. Add a client secret and copy its value.
  3. Add the Microsoft Graph application permissions above and grant admin consent. One registration with all three permissions serves both connections.
Changes are read through each drive’s delta feed. Site discovery searches every site, so Sites.Selected alone is not enough.

​
Google Drive

  • One datastore per shared drive. Users’ My Drive folders are not discovered.
  • Reads files. Google Docs, Sheets and Slides are exported as text, CSV and text, within Google’s 10 MB export limit. Other Google-native types are not read.
  • Scope https://www.googleapis.com/auth/drive.readonly.

​
Slack

  • One datastore per channel, public and private.
  • Reads channel files, channel messages (one item per UTC day) and thread replies (one item per thread). Direct messages are not read.
  • Field a Bot token (xoxb-...).
  1. Create a Slack app and add the bot token scopes channels:read, groups:read, files:read, channels:history and groups:history.
  2. Install the app to the workspace and copy the Bot User OAuth Token.
  3. Invite the bot to each channel to scan (/invite @your-app). It reads only channels it belongs to.
Without the history scopes, only files are read and the datastore shows a warning.

​
Jira and Confluence

JiraConfluence
One datastore perSiteSite
ReadsIssue attachments, and one text item per issue with the summary, description and every commentPage and blog post bodies, and attachments
Account needsBrowse permission on the projectsView permission on the spaces
FieldsSite, Atlassian account email, API tokenThe same
  1. Sign in as the account TigerGate will use and create an API token (Atlassian account → Security → API tokens).
  2. In TigerGate, enter the site (acme or https://acme.atlassian.net), the account email and the token.
  3. Choose API token for a classic token. A token created with scopes needs API token with scopes, which is sent through api.atlassian.com.
Jira worklogs and custom text fields, and Confluence drafts and comments, are not read. If the token cannot read Confluence page bodies, the attachments are still read and the datastore shows a warning.

​
Zendesk

  • One datastore per Zendesk instance.
  • Reads attachments on ticket comments. Comment text is not read.
  • Fields the Subdomain (the part before .zendesk.com), then one of:
    • OAuth client (recommended): as an admin, go to Admin Center → Apps and integrations → APIs → OAuth clients, add a confidential client that uses client credentials, and enter its Client identifier and Client secret.
    • API token (older accounts only): an admin’s Admin email and API token. Zendesk is retiring API tokens; accounts created from 28 July 2026 cannot use them.
The incremental ticket export is available to admins only, so the credential must act as an admin.

​
ServiceNow

  • One datastore per instance.
  • Reads record attachments (sys_attachment).
  • Fields the Instance (acme or acme.service-now.com), then Username and password, or OAuth refresh token (client ID, client secret and refresh token).
Create an integration user, or an OAuth client for one, with snc_read_only together with a role that reads the records holding the attachments, such as itil for incidents, problems and changes. snc_read_only on its own grants nothing. Deletions are read from sys_audit_delete, which needs admin or a read ACL; without it, deleted attachments are found at the next full rescan.

​
Salesforce

  • One datastore per org.
  • Reads Salesforce Files (the latest version of each file).
  • Fields the Instance URL (your My Domain URL, such as https://acme.my.salesforce.com, not login.salesforce.com), the Consumer key and Consumer secret, and a Refresh token for that method.
Create an External Client App with OAuth enabled and the api scope (add refresh_token for the refresh-token method). For Client credentials, enable the client credentials flow with a run-as user. The run-as user needs read access to files: grant “Query All Files” or “View All Data” to read every file. An existing connected app also works.

​
Box

  • One datastore per enterprise.
  • Reads the files of the app’s Service Account and, with the as-user header, of every active managed user.
  • Fields Client ID, Client secret and Enterprise ID (Admin Console → Account and Billing).
  1. Create a Box Platform app with server authentication (client credentials grant).
  2. Give it the Read all files and folders stored in Box scope and App + Enterprise access.
  3. To read every user’s files, also enable Make API calls using the as-user header and Manage users.
  4. Authorise the app in the Box Admin Console.
Without as-user access, only content shared with the app’s Service Account is read, and the datastore says so.

​
Dropbox

  • One datastore per connection.
  • Reads every file under the app’s root.
  • Fields App key, App secret and Refresh token.
Create a Dropbox app with scoped access, add the files.metadata.read and files.content.read permissions, and obtain a refresh token by authorising with offline access (token_access_type=offline).

​
SaaS warehouses

The warehouse must be reachable from TigerGate over a public address. A database reachable only inside your network is read by the on-prem scanner instead, and databases in your cloud accounts by that account’s in-account scanner. With the default full profile, tables are read in full through the warehouse’s server-side cursor. A changed table is read whole again; there is no row-level delta.

​
Snowflake

  • One datastore per database. System databases are skipped.
  • Changes detected per table from its last-altered time, row count and bytes.
  • Fields Account Identifier (the part before .snowflakecomputing.com), User, Role (optional; blank uses the user’s default), Warehouse, and Private Key (PEM): the unencrypted PKCS#8 key.
Create a read-only service user with key-pair authentication, a role with USAGE on the databases and schemas and SELECT on their tables, and a warehouse it can use. An X-Small warehouse is enough. 
CREATE ROLE DSPM_READER;
CREATE USER TIGERGATE_DSPM TYPE = SERVICE DEFAULT_ROLE = DSPM_READER;
ALTER USER TIGERGATE_DSPM SET RSA_PUBLIC_KEY = '<public key, without the header lines>';
GRANT ROLE DSPM_READER TO USER TIGERGATE_DSPM;
GRANT USAGE ON WAREHOUSE DSPM_WH TO ROLE DSPM_READER;
GRANT USAGE ON DATABASE <database> TO ROLE DSPM_READER;
GRANT USAGE ON SCHEMA <database>.<schema> TO ROLE DSPM_READER;
GRANT SELECT ON ALL TABLES IN SCHEMA <database>.<schema> TO ROLE DSPM_READER;

​
Databricks

  • One datastore per Unity Catalog catalog. The system and samples catalogs are skipped.
  • Changes detected per table from its last-altered time.
  • Fields Workspace URL, Access Token, SQL Warehouse ID (optional) and Catalog (optional; blank reads every catalog the token can see).
The token’s user or service principal needs USE CATALOG, USE SCHEMA and SELECT on the catalogs to scan, and permission to use the SQL warehouse. Without a warehouse ID, catalogs and tables are inventoried and reported as not read.

​
MongoDB

  • One datastore per database. System databases are skipped.
  • Changes detected per collection from its document count, size and highest _id.
  • Fields Connection URI (for example mongodb+srv://cluster0.abcde.mongodb.net, without a user or password), User, Password, Authentication Database (optional) and Database (optional; blank reads every non-system database).
Create a database user with the read role on the databases to scan, or readAnyDatabase, and allow TigerGate’s address in the cluster’s network access list.

​
Known gaps

Some changes are found only at the periodic full rescan, because the providers’ change feeds do not report them:
  • a reply to a Slack thread whose parent is older than the incremental window, and Slack messages deleted from earlier days;
  • a file unshared from a Slack channel but not deleted;
  • a Confluence page restored from the trash, until it is edited again.
For Jira, Confluence and Slack files, deletions that no feed reports are also looked for on every incremental run, a batch of indexed items at a time.