Troubleshooting Google Workspace Setup Errors

Topic

This article describes common Google Workspace setup errors and how to resolve them.

Environment

• NinjaOne SaaS Backup
• Google Workspace

Description

NinjaOne SaaS Backup integrates with Google Workspace for a variety of complex functions. You may sometimes encounter errors when setting up the integration between the two systems. This article can help you troubleshoot common problems when they arise. Select a topic to learn more:

• Google Workspace Authentication Errors
  • The signed in account doesn't have the required admin permissions 
  • Missing Google Cloud Permissions
• Google Cloud Project Creation Errors
  • Google Cloud Terms of Service have not been accepted
  • Something went wrong while creating the project
• Automated Setup Errors
  • Failed to configure organization policies
  • Creating a service account encountered an error
• Email Connection Errors
  • Some workloads could not be connected. Check permissions and retry
• Additional Resources

Google Workspace Authentication Errors

This section describes errors you may encounter when authenticating Google Workspace and how to resolve them.

The signed in account doesn't have the required admin permissions

This error occurs when the Google account used for login lacks the required administrator permissions to complete the setup. NinjaOne requires a Google Workspace administrator account with owner or editor access during setup because the onboarding process includes tenant-level authorization and domain-wide delegation. A regular user cannot approve access for the entire Google Workspace tenant.

To resolve this issue, follow these steps:

1. Sign out of the currently connected Google account.
2. Return to the Google Workspace Authentication page.
3. Select Reconnect.
4. Log in with a Google Workspace account that has the required administrator permissions.
5. Complete the Google authorization process again.

Missing Google Cloud Permissions

Google Cloud permission is required during the initial Google sign-in process. This permission allows NinjaOne to create and configure the Google Cloud resources needed to complete the Google Workspace setup.

During the initial Google sign-in process,  you must select the permission checkbox before selecting Continue.

If you continue without selecting the permission checkbox, an error message appears stating that you must grant the requested permission:

To resolve this issue:

1. Select Retry Now, then sign in again with your Google Workspace administrator account.
2. Wait for the Google sign-in process to complete.
3. Confirm that the Google Sign In step displays a check mark and is marked Connected.

Google Cloud Project Creation Errors

This section describes errors that can occur when NinjaOne SaaS Backup attempts to create a Google Cloud project.

Google Cloud Terms of Service have not been accepted

NinjaOne SaaS Backup needs to create and configure Google Cloud resources during setup. Before these resources can be created, your organization must accept the Google Cloud Terms of Service.

If the Terms of Service have not been accepted, NinjaOne SaaS Backup cannot create or configure the required Google Cloud organization, project, service account, or API resources.

To resolve this issue:

1. Log in to Google Cloud using your Google Workspace super administrator account.
2. Review and accept the Google Cloud Terms of Service.
3. Return to NinjaOne SaaS Backup and retry the project creation process.

Something went wrong while creating the project

Accepting the Terms of Service is only one of several requirements. Project creation can still fail for other reasons. Common causes include the following:

• Insufficient administrator permissions
• Google Cloud organization policy restrictions
• Project quota limits
• Billing configuration
• API restrictions
• Signing in to the wrong Google Workspace tenant

If the issue persists, verify that you are signed in to the correct tenant with the required permissions and that your organization allows you to create new Google Cloud projects.

Automated Setup Errors

This section describes errors you may encounter during the automated setup process and how to resolve them.

Failed to configure organization policies

This error appears when the iam.allowedPolicyMemberDomains organization policy is enforced and the required service identity is not included in the list of allowed domains or organizations. The policy prevents NinjaOne SaaS Backup from granting the required IAM roles to the service identity used during setup.

To resolve this issue, update the organization policy for the NinjaOne SaaS Backup project to allow the required service identity, then retry the setup.

To update the organization policy, follow these steps:

1. Sign in to the Google Cloud console.
2. Navigate to IAM & Admin → Organization Policies.

3. From the project picker at the top of the page, select the NinjaOne SaaS Backup project.
4. Scroll down and type iam.allowedPolicyMemberDomains in the search box. 
5. Verify the Enforcement state for the policy is listed as Inactive.

6. Scroll down and type iam.managed.allowedPolicyMembers in the search box, and verify this policy is also set to Inactive: 

If either policy is active, you'll need to deactivate it. To deactivate a policy, follow these steps:

1. Select the policy.
2. Verify Applies to points to the NinjaOne SaaS Backup project, then click Manage policy.

3. Select Override parent's policy. 
4. Click the existing Deny All/Allow All rule, if there is one, or click Add a rule if there's no rule yet.
5. Set Allow All for the rule, then save your changes by clicking Set policy.

6. Return to NinjaOne SaaS Backup and select Retry Setup to try the Automated Setup again.

Creating a service account encountered an error

This error appears when NinjaOne SaaS Backup is unable to complete service account creation during the automated setup. This can sometimes occur while the new Google Cloud project configuration is still being applied. Follow these steps to resolve the problem:

1. Wait a few minutes to allow the new project configuration to complete.
2. Select Retry.
3. If the error persists, confirm that you signed in with a Google Workspace administrator account that has the required permissions.
4. Select Open Google Cloud Console and confirm that the NinjaOne SaaS Backup project is selected.
5. Verify your account has permission to create service accounts in the project. You can follow the same steps described in the To update the organization policy, follow these steps section above.
6. Return to NinjaOne SaaS Backup and select Retry.

If the service account still cannot be created, contact NinjaOne Support for assistance.

Email Connection Errors

This section lists common email connection errors and how to resolve them.

Some workloads could not be connected. Check permissions and retry

This error appears when the Email workload cannot connect during the Automated setup. This can occur for either of the following reasons:

• Your Google Workspace subscription does not include Gmail. The minimum required subscription is Google Workspace Business Starter.
• The Gmail service status is set to Off for everyone in the Google Admin console.

To resolve this issue, first confirm that your Google Workspace subscription includes Gmail. If it does not, you must upgrade to Google Workspace Business Starter or another subscription that includes Gmail.

If your subscription includes Gmail, check its service status by following these steps:

1. Sign in to the Google Admin console.

2. Navigate to Apps → Google Workspace → Gmail.

3. Select Service status.

4. If it is not already activated, click On for everyone to activate the service.

5. Select Save.

6. Return to the setup page and select Retry Verification.

Additional Resources

Google offers an extensive troubleshooting library for Google Workspace Administrators:

Google Workspace Admin Help (external link)