GAM fail on check service account

[Sam Carre]

Morning All

Having an issue trying to check the states of the service accounts after authorising new client ID in the API Controls, Domain-wide delegation.

When I click Authorise it tells me that there were 40 scopes added then when I go back to GAM to run: gam user ad...@domain.com check serviceaccount it passes on the top 3 then fails as per below:

Domain-wide Delegation authentication:, User: ad...@domain.com, Scopes: 39
  https://mail.google.com/                                                  FAIL (1/39)
  https://sites.google.com/feeds                                            FAIL (2/39)
  https://www.googleapis.com/auth/analytics.readonly                        FAIL (3/39)
  https://www.googleapis.com/auth/apps.alerts                               FAIL (4/39)
  https://www.googleapis.com/auth/calendar                                  FAIL (5/39)
  https://www.googleapis.com/auth/chat.admin.delete                         FAIL (6/39)
  https://www.googleapis.com/auth/chat.admin.memberships                    FAIL (7/39)
  https://www.googleapis.com/auth/chat.admin.spaces                         FAIL (8/39)
  https://www.googleapis.com/auth/chat.delete                               FAIL (9/39)
  https://www.googleapis.com/auth/chat.memberships                          FAIL (10/39)
  https://www.googleapis.com/auth/chat.messages                             FAIL (11/39)
  https://www.googleapis.com/auth/chat.spaces                               FAIL (12/39)
  https://www.googleapis.com/auth/classroom.announcements                   FAIL (13/39)
  https://www.googleapis.com/auth/classroom.coursework.students             FAIL (14/39)
  https://www.googleapis.com/auth/classroom.courseworkmaterials             FAIL (15/39)
  https://www.googleapis.com/auth/classroom.profile.emails                  FAIL (16/39)
  https://www.googleapis.com/auth/classroom.profile.photos                  FAIL (17/39)
  https://www.googleapis.com/auth/classroom.rosters                         FAIL (18/39)
  https://www.googleapis.com/auth/classroom.topics                          FAIL (19/39)
  https://www.googleapis.com/auth/cloud-identity                            FAIL (20/39)
  https://www.googleapis.com/auth/cloud-platform                            FAIL (21/39)
  https://www.googleapis.com/auth/contacts                                  FAIL (22/39)
  https://www.googleapis.com/auth/contacts.other.readonly                   FAIL (23/39)
  https://www.googleapis.com/auth/datastudio                                FAIL (24/39)
  https://www.googleapis.com/auth/directory.readonly                        FAIL (25/39)
  https://www.googleapis.com/auth/documents                                 FAIL (26/39)
  https://www.googleapis.com/auth/drive                                     FAIL (27/39)
  https://www.googleapis.com/auth/drive.activity                            FAIL (28/39)
  https://www.googleapis.com/auth/drive.admin.labels                        FAIL (29/39)
  https://www.googleapis.com/auth/drive.labels                              FAIL (30/39)
  https://www.googleapis.com/auth/gmail.modify                              FAIL (31/39)
  https://www.googleapis.com/auth/gmail.settings.basic                      FAIL (32/39)
  https://www.googleapis.com/auth/gmail.settings.sharing                    FAIL (33/39)
  https://www.googleapis.com/auth/keep                                      FAIL (34/39)
  https://www.googleapis.com/auth/meetings.space.created                    FAIL (35/39)
  https://www.googleapis.com/auth/spreadsheets                              FAIL (36/39)
  https://www.googleapis.com/auth/tasks                                     FAIL (37/39)
  https://www.googleapis.com/auth/userinfo.profile                          FAIL (38/39)
  https://www.googleapis.com/auth/youtube.readonly                          FAIL (39/39)
Some scopes FAILED!

Not sure why Google is stating 40 & GAM is stating 39 not sure if this has anything to do with it failing.

I've also run the Authorise a few times & still fails.

Any help would be gratefully received.

Many thanks

Sam

[Jay Lee]

It can take minutes to hours after you authorize the client id in the admin console DwD page before the API access is fully applied to the user and GAM is able to get a PASS. How long have you waited?

One trick to speed up the process when confirming with a single user. Move the user out of their current OrgUnit and then back into it. This causes Google to re-evaluate the user's policies including which client IDs have DwD set. Then you can run

gam that...@example.com check serviceaccount

And you should get PASSes 

Jay

--
You received this message because you are subscribed to the Google Groups "GAM for Google Workspace" group.
To unsubscribe from this group and stop receiving emails from it, send an email to google-apps-man...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/google-apps-manager/f63da007-0f46-4b95-82b1-0ce9bb11d02an%40googlegroups.com.

[Sam Carre]

Thank you.

I setup GAM this morning so I'll wait until tomorrow to check again.