Skip to main content
Troubleshooting Google Workspace sync issues

Find out what to do if you are having issues with syncing users or groups from Google Workspace.

Courtney Leacock avatar
Written by Courtney Leacock
Updated over a week ago

Here's what to do if:

How can I stop shared inboxes from being brought over?

You can stop any accounts from being brought over by adding them to the sync deny list.

How can I stop inactive users from being made active by the sync?

If you don't wish an inactive user to be made active by the Google Workspace sync, you can add the user's email address to the sync deny list. You can do this in the Sync Wizard in the Google Workspace sync configuration page in your platform settings.

What should I do if users are missing from my sync?

The most common reason for missing users is that you've run a Test Sync, instead of a Manual Sync. You can run a Manual Sync from the Google Workspace Sync page. If that doesn't resolve your missing users issue, please follow our guide to troubleshooting missing users below.

What should I do if my User Limit has been exceeded?

The sync will fail if the total number of all users (active or inactive) on your account exceeds the user limit placed upon it if present. The Summary sheet on the spreadsheet attachment of your sync summary includes an Updated User Count and User Limit. These figures will give you an impression of how far over the limit the account is. Sync failure alerts do not always include a full summary or attachment, you can run a test sync to obtain this data.

To get the sync working you will either need to delete users or have the user limit on your account increased.

The sync does not delete users but rather sets them to inactive. The idea is to provide a recycle bin of users who you can delete when you no longer need them. You can view your inactive users on the Users page and delete them as you see fit. Similarly you should review the Users Deactivated sheet on the sync summary spreadsheet attachment as you can also delete these users to bring your total down.

What privileges do I need to authorise the Google Workspace sync?

You will need to have the correct privileges set on your Google account in order to set up the Google Workspace sync. View a list of the requirements below.

How do I handle an 'admin_policy_enforced' 400 error when authenticating with Google?

You may encounter an 'admin_policy_enforced' error when using Delegated User authentication to set up your Google Workspace sync. This error happens when your Google Workspace is configured to block API access by third party applications.

You can grant our Sync Integration application API access in the Google Admin Console.

  1. Go to Security > Access and Data Control > API Controls

  2. In App access control, click Manage Third-Party App Access.

  3. Click Add a filter under Configured apps and select OAuth App Name or Client ID

  4. Enter our Client ID -

  5. Select usecure Sync Integration from the results

  6. Tick the box for our Client ID and click Select

  7. Set App access to Trusted and click Continue

You should now be able to complete the sync authentication process as expected.

How do I resolve an 'Invalid Input' error on my sync?

This error typically occurs when the Delegated User Email in your sync's Service Account Authentication configuration is not set correctly.

The Delegated User Email field must be set to that of a Google Workspace user with sufficient rights to make the Google Directory API requests required by the sync. You can view those privileges here.

You cannot use the email address of the service account as the Delegated User Email. It is not a real Google Workspace user and will not work. The service account is used by the sync integration to make API requests on behalf of a user rather than acting in lieu of a user.

How do I resolve an 'Access not configured' error?

If your Google Workspace sync fails with the message 'Error: access_not_configured', the authentication token we hold for your account may have expired and you can resolve the issue by re-authenticating with Google Workspace. You can do so from the Google Workspace sync set-up wizard in the platform settings.

What should I do if the groups in my sync configuration are missing?

The sync will fail if the groups you selected to load users from no longer exist in Google Workspace. Typically this is because the selected groups have been deleted from Google Workspace since the Google Workspace sync was configured on your account.

Under these conditions you would see the warning message below in the View Current Setting option on the Google Workspace sync settings page.

You would also see the error below in the Summary sheet in the Sync Summary email's spreadsheet attachment on a test or manual sync:

No allow listed groups found in the group data from the synced API

You can resolve this issue by running the configuration wizard and selecting new groups on the Group Configuration step.

What should I if my sync fails because it can't find any users?

The Google Workspace sync establishes a synced dataset based on your Google Workspace data and the filtering configuration of your sync. The sync will fail if it can't find any users that comply with your filtering preferences or the system's requirements for user records. The system requires that users have a first name, last name and a valid email address that conforms with your domain lock if enabled.

The Sync Summary email can give further information about this. The Users Loaded count will be 0 if all users fail to meet the system's requirements for user records. The Users Processed count will be 0 is there are no users in the synced dataset after filtering.

The error message in the Summary sheet of the Sync Summary spreadsheet attachment can also highlight the reason for this.

  • No users loaded from API - The sync could not load users from the Google Directory API.

  • No viable users loaded from API - The sync could load users from the Google Directory API but none of them meet the system's requirements for user records. Depending on your sync settings, suspended users, archived users or those without a mailbox setup are not considered viable.

  • No users present after filtering - The sync found users that fit the system's requirements but none of them comply with your filtering preferences.

To resolve these issues you should run the steps in this article and check whether the groups in your sync's filtering preference contain users in Google Workspace.

Did this answer your question?