It seems that Google Devs like to remove policies. It seems they have to think about how GPO works.
I had to add an entry for "SigninAllowed" myself cause YOU CANT IGNORE A POLICY YOU HAVE SET IN THE PAST. GPO is a one-way-ticket.
I set these policy to a specific OU about 2 years ago. Now the OU must be able to sync with Google acounts. But they were unable to sign in.. there was no set sign-in policy findable.