GAM - Can't access this service

[Bankesy]

Good morning,

 

Hoping somebody here can help me as I am new to Google Classroom and GAM and keep getting stuck when trying to configure it.

 

I'm still quite new to my current environment but as I understand it the last IT Network Manager had GAM setup on his PC but this installation was lost.

 

I also gather that Azure is syncing any distribution group from our Active Directory to Google.

 

All I'm trying to do is configure GAM so I can mass delete duplicate groups on the Google side but every time I try to setup GAM I get as far as being asked to visit this site:

 

https://console.cloud.google.com/apis/credentials/...

 

Only to be redirected to families.google.com and told that I cannot access the service as it is "unavailable for Google Workspace for Education users marked as under the age of 18 by their administrator"

 

And I get this even when using the administrator account so something isn't right somewhere I suspect.

 

If anybody has any ideas I would appreciate it.

 

Kind regards

[fiza]

If you are getting the Age restriction have you checked in your Google Admin Console whether the OU where the Administrator account is actually has the correct age group allocated? The correct option for this should be "All users in this group or org unit are 18 or older". Any OUs with students in should be "Some or all users in this group or org unit are under 18"

 

Hope that helps

[Bankesy]

@fiza

 

When I look at the Organizational Units it appears there is only one, named after the domain. I can't seem to do much with it or set age limits and the administrator account is in that OU.

 

Thanks

[fiza]

@fiza

 

When I look at the Organizational Units it appears there is only one, named after the domain. I can't seem to do much with it or set age limits and the administrator account is in that OU.

 

Thanks

@Bankesy when you first log into the Admin Console go to Account>Account Settings and scroll to the bottom. There you should see "Age-based access settings", click on this and it should take you the page where you set age based restrictions. Your domain should really have an OU structure to seperate out Staff and Student accounts so that you can put different permissions in place. How are you differentiating between student and staff permissions in the Google Admin console at the moment?

[Bankesy]

@fiza

 

Yes I see that setting now, my assumption is that my predecessor marked it as everybody over 18 to setup GAM and then switched it back or did something clever to mark the one account he was using for setup as 18+ maybe.

 

I really don't think there is any differentiation, I've just inherited this the way it is.

[jthompson]

At the very least you could add an OU to hold the admin user(s) and set that to over 18. In fact, even if you end up with separate staff an student OUs, it's a good idea to keep a separate admins OU as well for other little bits of differentiation.

[Bankesy]

@fiza @jthompson

 

I've got a bit further with this:

 

I can now get as far as the part where the browser loads and is supposed to give a verification code but all I get is this:

 

Authorization Error

 

Error 400: admin_policy_enforced

Account restricted

Learn more

Request Details

The content in this section has been provided by the app developer. This content has not been reviewed or verified by Google.

If you’re the app developer, make sure that these request details comply with Google policies.

 

Anything obvious that I'm missing? I'm using the main super admin account for the organisation and have temporarily set the one OU we have to 18+.

 

Thanks

[dmj]

Look at the GCP IAM settings, Google Workspace and GCP don't automatically use the same admin levels, you can be an admin in one and not the other.

I suspect the account you're using doesn't have permission to use the API - which is defined in GCP: https://console.cloud.google.com/

[Bankesy]

@dmj

 

The administrator account I'm using is on the project as an owner?

 

Thanks

[dmj]

@dmj

 

The administrator account I'm using is on the project as an owner?

 

Thanks

 

That would be sufficient permissions. Perhaps the API key isn't on your machine?. I'd go through the gam setup docs from scratch.

[dmj]

Thinking about it, did you try running

gcloud auth login

[Frodo_Baggins]

Re-authing usually fixes my issues with GAM, or re-approving API permissions when someone removed them. If your still struggling might be worth reaching out via Github\ Google Group (posted before on the one for GAMADV+ and creator was really helpful and joined a Teams call)

[Bankesy]

@dmj @Frodo_Baggins

 

Thanks for your replies, I was able to see my predecessor yesterday who set all of this up in the first place and it seems like I'm getting that error because the administrator account isn't authorised to set one of the permissions from the list produced during the GAM setup.

 

If I select just a few at random I no longer get the error so hopefully I can work out which ones I am allowed to set and which ones I actually need to be able to manage groups via GAM.