How to Fix Invalid Grant Error During Google Workspace Migration
Question details
Users encounter an authentication or permission error preventing a successful email and data migration from Google to Microsoft 365.
- Product
- Microsoft 365 / Google Workspace
- Device & OS
- not provided
- Scenario
- Administrators are attempting to migrate organizational data from Google Workspace to Microsoft 365.
- Observed behavior
- The migration process fails, returning a MigrationPermanentException, invalid_grant, or invalid user error.
Ensure you have super administrator privileges in your Google Workspace console and global administrator rights in your Microsoft 365 admin center before proceeding.
Verify User Accounts and License Assignments
Ensure that the source and target email accounts match perfectly and have the appropriate licenses to receive migrated data.
A common cause of the invalid user error is a mismatch between the Google Workspace email address and the Microsoft 365 email address, or the lack of an active Exchange Online license on the destination account.
Log into both the Google Workspace Admin console and Microsoft 365 Admin Center. Verify that the email addresses for the users being migrated are spelled identically on both platforms.
In the Microsoft 365 Admin Center, go to Users > Active users. Select the user accounts targeted for migration and ensure they have an active license that includes an Exchange Online mailbox.
Reconfigure Google Workspace APIs and Service Account
Verify that all required APIs are enabled and that your service account JSON file is correctly configured for the migration endpoint.
Enable Two-Step Verification and App Passwords
Use this method if you are performing an IMAP migration rather than a Google Workspace migration batch, which requires individual app passwords.
Looking for a cost-effective productivity suite?
If your organization is restructuring its software subscriptions during a migration, consider WPS Office. It provides powerful word processing, spreadsheets, and presentation tools that are highly compatible with Microsoft formats, without the expensive licensing fees.
- 1. Download and install: Visit the official WPS Office website and download the installation package for your operating system.
- 2. Open your documents: Launch WPS Office and open your existing .docx, .xlsx, or .pptx files directly without any conversion steps.
- 3. Collaborate easily: Use built-in cloud storage to share files and collaborate with your team instantly.
Frequently Asked Questions
What does the 'invalid_grant' error mean during an email migration?
The 'invalid_grant' error generally means there is an authentication failure. It occurs when Microsoft 365 cannot authenticate against Google Workspace, usually because the service account JSON key is invalid, API scopes are incorrect, or domain-wide delegation was not set up properly.
Which specific APIs need to be enabled in Google Workspace for Microsoft 365 migration?
To perform a successful Google Workspace to Microsoft 365 migration, you must enable the Gmail API, Google Calendar API, People API, and Contacts API within your Google Cloud Console project.
Why do I need a Google Workspace Super Administrator account?
A Super Administrator account is strictly required to authorize domain-wide delegation for the service account. This allows the migration service to access and export mail, calendar, and contact data across all users in the organization without needing individual passwords.
Are App Passwords required for all Google Workspace migrations?
No. App Passwords are only required if you are using an IMAP migration method. If you are using the dedicated Google Workspace migration tool in the Exchange Admin Center, you use a service account JSON file instead.
