Google Workspace provisioning flow fails with the following error visible in the Okta dashboard.
Automatic provisioning of user <username> to app Google Workspace failed: Failed to push profile update. Resource Not Found: <resource>
- Google Workspace
- Provisioning
- API
This error is due to one of the following reasons:
- The Google Workspace administrator credentials used for creating the API connection are invalid.
- The authentication token is invalid.
- The permissions of the account used for creating the API connection are incorrect on the Google Workspace side. Permissions of the account may have changed, and it is not the Google Workspace Admin account.
- The end user's Google account was recently recovered and has not completed the security hold waiting period.
Solution 1: Re-authenticate the integration with Google Workspace
-
Go to Okta Admin Console and navigate to Applications > Applications > Google Workspace > Provisioning > Integration > click the Edit button.
-
Click Re-authenticate with Google Workspace.
- Enter the Google Workspace Admin account credentials:
- Enter the admin username.
- Enter the admin password.
- Review the list of permissions Google will grant Okta in the Google Workspace tenant. If acceptable, click Allow.
- Back on the Provisioning page in Okta, a message will confirm the successful authentication and click Save.
- Attempt the failed tasks again. Navigate to Dashboard > Tasks. Any failed assignments should appear under Tasks.
- After identifying the failed task for the user that should be retried, click on Retry Selected.
Solution 2: Wait for the Google Account Recovery Security Hold Period
If the Google account was recently recovered, it will need to wait 24-48 hours for the recovered account to be fully active. Google places a security hold on recovered accounts as a security measure for their recovery process. Once the security hold period has been completed, proceed to retry the failed task or re-assign the user to the application.
