Google App Access - Blocked

[Koldov]

Hopefully a really simple one, but we don't use Google very much, so I haven't got a lot of experience and I haven't had enough coffee yet!

 

SLT has asked why Canva is blocked for the teachers, which is strange because I unblocked it last year sometime... and the SLT in question uses it regularly.

 

Checked in Google Admin for - Apps > Google Workspace Marketplace Apps > Canva > Allowlist setting

 

and 'Allow App' is selected for the Teacher OU.

 

Thing is, the SLT user in question is in the same OU as the Teachers!

 

Tested it for my OU and it is also blocked... 'Access blocked: Authorization Error - Access to this app or website log-in has been restricted by XYZ School - Error 400: admin_policy_enforced'

 

My OU also has 'Allow App' selected!

 

However, looking further into it, I can see at some point I must have put Canva in at the Top Level as an  'Excluded App' and is Denied, but also looking in the 'Allow List' apps,  it is in the teachers OU and 'Override' is selected, but it's not even in the Top Level OU. I'm not sure why it is in both, presumably to my logic I couldn't see how to only allow it for some OUs at the time, so put in as a blocked app AND then also an allowed app for some OUs... very confusing!

 

So...

 

Question 1. Do I need to configure this differently? Do I just put it in 'Allow Listed Apps' and if so then how do I block it for OUs I don't want it in?

 

Question 2. I remember having to allow some apps in another section of the Admin console... What effect does 'Security > API controls > App access control' have and do I need to configure it here as well?

[TheHyperTechie]

I have always done the Security > API controls > App Access Control "way" to configure/block access to an app, and can't say I've ever had any issues.

[Koldov]

Hmmmm... any idea why there's two places to basically configure the same thing then? 

 

Does Apps > Google Workspace Marketplace Apps > have finer/more granular controls (I can't see any)?

 

OK, to make matters worse I have just searched for it in 'Security > API controls > App access control' and.... it's blocked here as well!

 

I must have been on a right one that day...

 

Anyway, at least now this all makes sense as to why it's blocked for the teachers...

 

Also, when I searched for 'Canva' there's quite a few 'web' entries (not including Android or iOS), which one do you choose?

Edited January 19 by Koldov

[TwistedHelixis]

I seem to remember getting an error like that while setting up SSO. Did you ever start setting SSO up, but not complete all the steps?