google workspace sso error 400 admin_policy_enforced

google workspace sso error 400 adminpolicyenforced

TL;DR

Error 400 adminpolicyenforced is the Workspace admin's blocklist doing its job: the app is not trusted. A Workspace admin opens Security, then Access and data control, then API controls, then Manage third-party app access, and marks the app's OAuth client ID as Trusted. The user retries the login and it succeeds.

google workspace sso error 400 admin_policy_enforced

Use this when

• Google SSO login fails with Error 400 adminpolicyenforced
• A third-party app's Google sign-in worked for consumers but fails for Workspace users
• The error appears right after choosing the Google account

Not for this skill when

• Consumer Gmail accounts hitting the same app (no admin policy involved)
• OAuth errors with different codes (fix those on their own terms)
• Admins who intentionally block the app (that is policy, not an error)

Steps

Step 1: Confirm the error and the app

Reproduce the login and note the exact 400 adminpolicyenforced error and which app requested access. Expected: you can name the blocked app's OAuth client ID.

Step 2: Open third-party app access

In the Google Admin console go to Security, Access and data control, API controls, then Manage third-party app access. Expected: you see the list of configured apps and access settings.

Step 3: Mark the app Trusted

Add the app by its OAuth client ID and set its access to Trusted. Expected: the app appears in the trusted list.

Step 4: Retry the login

Have the user sign in again through the app. Expected: the OAuth consent completes and the app session starts.

Step 5: Verify the grant

Check the user's account security settings to confirm the app now holds the expected scopes. Expected: the grant is listed with correct scopes.

Step 6: Check OU scoping

If some users still fail, check whether the trust was applied to the right organizational units. Expected: the setting covers every OU that uses the app.

Tool compatibility

Google Workspace Admin console; Google Identity OAuth 2.0; third-party SSO apps using Sign in with Google.

Variant phrasings

Variant 1

error 400 adminpolicyenforced google workspace fix

Variant 2

google oauth blocked by admin third party app access

Variant 3

adminpolicyenforced sso google apps allowlist oauth client

Why it happens

Google Workspace lets admins control which third-party apps may request OAuth scopes, and the default posture in many organizations blocks everything not explicitly trusted. When a user tries to sign in to such an app, Google stops the flow before any consent screen with adminpolicyenforced: the policy, not the user's account, refused. This commonly surfaces during new SaaS rollouts where the app was tested with consumer accounts (no policy) and then fails for every Workspace user. The fix is administrative rather than technical, which is why developer-side debugging goes nowhere: only the allowlist entry resolves it.

Edge cases / pitfalls

• The Block all third-party API access setting overrides per-app trust; check the global setting first.
• Trust can be scoped per OU, so a fix that works for one department may not cover another.
• The app's OAuth client ID is the trust key; if the vendor rotates client IDs, the trust breaks silently.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstbxrxEwDsel91b7hi8ezbw

Resolved from the public thread: https://vectle.com/posts/pstbxrxEwDsel91b7hi8ezbw

Thread query: google workspace sso error 400 adminpolicyenforced

TL;DR: Error 400 adminpolicyenforced is the Workspace admin's blocklist doing its job: the app is not trusted. A Workspace admin opens Security, then Access and data control, then API controls, then Manage third-party app access, and marks the app's OAuth client ID as Trusted. The user retries the login and it succeeds.