'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix OAuth Unauthorized Errors in Google Workspace to Microsoft 365 Migration
Question details
The user needs to resolve an OAuth unauthorized-client error that prevents the service account from retrieving access tokens during a migration.
- Product
- Microsoft 365 / Google Workspace
- Device & OS
- not provided
- Scenario
- Migrating emails, calendars, and contacts from Google Workspace to Microsoft 365.
- Observed behavior
- The migration fails with an OAuth unauthorized-client error because the service account lacks required API scopes or domain-wide delegation.
Ensure you have super administrator privileges in both your Google Workspace Admin console and Microsoft 365 Exchange admin center before attempting to configure service account scopes.
Enable Required APIs in Google Cloud Console
Activate the essential Google Workspace APIs in your migration project so the service account can access user data.
Log in to the Google Cloud Console and select the project associated with your migration service account.
Go to 'APIs & Services' > 'Library' using the left navigation menu.
Search for and enable the 'Gmail API', 'Google Calendar API', and 'Google People API' to ensure all required endpoints are active.
Configure Domain-Wide Delegation in Google Admin
Grant domain-wide delegation to your Google service account to allow Microsoft 365 to bypass individual user consent requests.
Looking for an Easier Alternative to Microsoft 365?
Avoid the complexities of server migrations, OAuth errors, and expensive licensing. WPS Office offers a powerful, seamless, and free alternative to Microsoft Office, letting your team focus on productivity rather than IT troubleshooting.
Frequently Asked Questions
Why do I get an 'unauthorized_client' error even after adding the scopes?
This typically occurs if the Client ID was entered incorrectly, if there is a typo in the scope URLs, or if the changes haven't propagated yet. It can take up to 24 hours for API control changes in Google Workspace to fully propagate.
What specific APIs must be enabled in Google Cloud Console for the migration?
You must explicitly enable the Gmail API, Google Calendar API, and Google People API (which handles Contacts) within your designated migration project in the Google Cloud Console.
Do I need to recreate the migration endpoint in Microsoft 365 after fixing scopes?
Yes. If a migration endpoint previously failed due to OAuth unauthorized errors, deleting and recreating the endpoint forces Microsoft 365 to fetch a fresh authorization token using your newly applied scopes.
Can I perform a Google Workspace to Microsoft 365 migration without domain-wide delegation?
No. Automated backend migrations to Microsoft 365 require a service account with domain-wide delegation so it can access all user mailboxes without prompting each individual user for login credentials.
