Cannot access Google Services after migration

[Philipp_Schwarz]

Hello everyone!
I hope there is someone among the experts on this platform who has a helpful tip or perhaps even the solution to my problem.
A few weeks ago, I became the first employee at my employer to be switched to administration via Google Cloud Identity Management or Google Workspaces and SSO by my colleagues in IT.

For exactly the same period of time, I have only been able to access certain Google applications / services and nobody really knows what needs to be done to get the rest working again. However, it would be important that I (as a backup of the Google Analytics admin, who should also have the link to all tools) have access to all tools in which I am also present as admin in the user administration.

I can call up and use the following applications / services in the browser: Google Ads, Google Analytics 360, Google Tag Manager 360, Search Ads 360, Campaign Manager 360, YouTube, Search Console, Google Alerts, Google News, Skillshop, Google Drive, Looker Studio.

I can NOT access and use the following applications / services in the browser: Display & Video 360, Google Marketing Platform, Google Company Profiles, Google Trends, Google Calendar, Cloud Skillsboost and certainly many more that I have not yet tested.

It is also strange that although I can access my data sources in Looker Studio, the dashboards do not provide any figures (only an error message)

It is also strange that although I can access my data sources in Looker Studio, the dashboards do not provide any figures (only an error message "Looker Studio cannot connect to your database"). If I use the same data source, for example a specific Google Analytics property or a Google Ads account that a colleague shares with me, I can see data in the dashboard and also work with it. Although I can also access Google Ads or Google Analytics directly myself and am of course also listed there as an admin.

I really hope that a solution can be found in this way. Neither my colleagues nor our Google support really know where the error lies at the moment.

In the admin administration of Workspaces, all Google services are enabled for all users.

Colleagues who have not yet migrated to Google Workspaces and therefore not yet migrated to SSO, but have the same admin rights in the individual tools, have no problems.

Best regards,
Phil

[Jan-Carlos]

Hello @Philipp_Schwarz, 

When you said you are migrated, you're talking about an unmanged google account to a Workspace managed account?
When you're saying SSO, you're talking about Single Sign-on or is it other service that i don't know?
If it is Single sing-on, that only apoints you to another directory instead of the Google's directory. This shouldn't be impacting your access to google service.

Can you send me some pictures of the errors or can you record the problem using this tool and upload the link to the video here, so we can understand better what is happening?

Best Regards, 

Jan Carlos

[Philipp_Schwarz]

Hello @Jan-Carlos 
Please excuse the late response, there have been some time-consuming projects at our company in the meantime and I haven't had time to look into the issue any further.

Absolutely right, I was an unmanaged account until the migration and was - until about an hour ago - a managed account without a workspace license.

You're right, by SSO I meant Single Sign-On. In our case, Google Cloud Identity Management was linked to Microsoft Azure Active Directory, which means that I can only log in to the company laptop via VPN. For example, if I go to ads.google.com and enter my email address, I am taken directly to a new window where I then have to enter my Windows password.

For about an hour now, our Google Cloud Identity Management Platform Admin has activated a Google Workspace Business Starter license (30-day trial period) for me. This is also working, I can see storage space in Google Drive again, for example.

What hasn't changed, however, is the error message I get when I try to access Google Marketing Platform or Display & Video 360. Although I am listed there as a user with standard access - we checked this earlier, even removed me and added me again - which worked perfectly before the migration.

Strangely enough, I can access other GMP services perfectly - Search Ads 360, Tag Manager 360, Campaign Manager 360, Analytics 360, Studio all work. Only the GMP main page and specifically Display & Video 360 do not.

I only get the error message here in German, which is why I have it translated briefly via Deepl:

"You do not have access to this service. Possible reasons why you do not have access:

Your account is managed by an organization that has disabled this service for its users.
Your account may have been temporarily disabled by your organization's administrator.
Your Google Workspace subscription may no longer be active.
If you want to access this Google service, try signing in with a different account. If you still need support, contact your organization's administrator."

Strangely enough, the error message for the GMP only reads:

"You do not have access to this service. Contact your organization's Google services administrator.

As an administrator of Google services, you can activate these services. Further information"

According to colleagues with admin rights, I am listed in GMP as a user with standard access and in DV360 with admin access. I cannot link DV360 as a data source in LookerStudio either.

Our Google contacts were still convinced that it was solely due to the fact that we had not purchased a Workspace license. Which I thought was unlikely at the time, after all, we spend a lot of money at DV360 and how illogical it would be to tell an active DV360 advertiser "Yes, it's great that you're running ads, but if you want to do identity management, you HAVE to buy a Workspace license so that you can continue to access the platform to manage your ads"....

Any tips would be appreciated. I'm getting really lost.

Best regards,
Phil

[Jan-Carlos]

Hello!

There's a "hidden" configuration that control many google applications that does not have individual control.

Try to check this:

Apps > Additional Google services > Access to additional services without individual

To me, many service got block because of this.

[Jan-Carlos · Accepted solution]

@Philipp_Schwarz 

I'm pretty sure that's the problem.
I deactivated the services configuration and all services that you posted got blocked to me.

[Philipp_Schwarz]

Thank you very much @Jan-Carlos , that was exactly the solution. My contact person for Google Cloud Identity managed to do exactly what you described, and now I can finally access all platforms again.

This is how I understood it for myself: If you use the "whitelisting" function, you can activate and deactivate certain Google tools. If you use "blacklisting", you allow everything, but can deactivate individual tools. The latter has meant that I can now finally use Looker Studio again without restrictions and also access DV360, Trends, etc. I am mega happy.

Many thanks again - and have a great weekend!

[Jan-Carlos]

I'm glad to know I could help.
The funny thing is that this same problem occurred with a customer in the same migration scenario...

[Philipp_Schwarz]

---

@Philipp_Schwarz wrote:

I can NOT access and use the following applications / services in the browser: Display & Video 360, Google Marketing Platform, Google Company Profiles, Google Trends, Google Calendar, Cloud Skillsboost and certainly many more that I have not yet tested.

---

Update on that: I can now access Google Calendar, but the rest is still the same as before. Why the heck would an admin use an access rule to prohibit a colleague from using Google Trends when logged in?

[Philipp_Schwarz]

---

@Philipp_Schwarz wrote:

It is also strange that although I can access my data sources in Looker Studio, the dashboards do not provide any figures (only an error message "Looker Studio cannot connect to your database"). If I use the same data source, for example a specific Google Analytics property or a Google Ads account that a colleague shares with me, I can see data in the dashboard and also work with it. Although I can also access Google Ads or Google Analytics directly myself and am of course also listed there as an admin.

---

I was just able to solve this by removing the access rights from all apps, including LookerStudio, in my Google account and then triggering a new authentication of the individual tools in LookerStudio. Yay!