Field note
ChatGPT Google Drive Scope Error: How to Fix It
When ChatGPT says Google needs admin approval, the cause is almost always an OAuth scope that your Google Workspace administrator has not trusted for the OpenAI app. Compare the scopes the connector asks for with the scopes the admin has approved.
When ChatGPT says Google needs admin approval, the cause is almost always an OAuth scope that your Google Workspace administrator has not trusted for the OpenAI app. Compare the scopes the connector asks for with the scopes the admin has approved.
Symptoms
- Connecting Google Drive in ChatGPT opens the Google sign-in, then stops with "This app is blocked", "Access blocked" or "admin_policy_enforced".
- The message says the app "needs approval from your admin" or asks you to contact your administrator.
- The connection was working, then failed after ChatGPT added a new feature that reads more data.
- Drive connects, but Gmail or Google Calendar does not, or the other way round.
- It works on a personal Gmail account and fails on the company Google Workspace account.
If your connection fails with a plain "something went wrong" and no mention of Google or admin, that is a different problem. Start with our note on ChatGPT "something went wrong" errors.
Why this happens
ChatGPT connects to Google using OAuth. When you connect Drive, ChatGPT asks Google for specific permissions, called scopes, such as read-only access to your Drive files. Google Workspace lets administrators control which third-party apps can use those scopes on company accounts. The control is called app access control, and it can be set to allow an app, limit it to specific scopes, or block it.
If the administrator has not marked the OpenAI app as trusted, or has trusted it only for a narrower set of scopes than ChatGPT now requests, Google refuses the sign-in and shows the admin approval message. This is Google enforcing the company's policy correctly, not a fault in ChatGPT.
The error appears at connection time because that is when the scopes are requested. It can reappear later when OpenAI adds a scope for a new capability, for example reading Gmail for a chat connector as well as syncing Drive for search.
Step-by-step fix
- Note the exact error text and the account you used. If the screen shows a client ID or an app name, keep it.
- Confirm you are signing in with the company Google Workspace account, not a personal Gmail account that happens to be open in the same browser. Sign out of the other Google accounts or use a separate browser profile.
- If you are on ChatGPT Team or Enterprise, confirm your ChatGPT workspace administrator has enabled the Google Drive connector for your workspace. If it is disabled there, the Google side never gets a chance to say yes.
- Send the error text and the connector name to your Google Workspace administrator. Ask them to trust the OpenAI app for the scopes ChatGPT requires, using the steps below.
- After the admin change, disconnect and reconnect the connector in ChatGPT. A stale consent will not pick up the new scopes on its own.
- Test with one folder of non-sensitive files before pointing it at shared drives.
What the Google Workspace administrator should check
In the Google Admin console, go to Security, then Access and data control, then API controls, then Manage third-party app access. Search for the OpenAI or ChatGPT app. If it is not listed, add it by its client ID from the error or from OpenAI's documentation, and set it to Trusted, or Limited with the required scopes.
While you are there:
- Check the default setting for unconfigured third-party apps. If it is "Block", every new AI connector will fail until someone explicitly trusts it. That is a reasonable policy, but it needs a request route that staff know about.
- Decide which organisational units may use the connector. You can trust the app for one unit, for example the marketing team, without opening it for finance or HR.
- Look at the scopes, not just the app name. Read-only Drive access is a very different decision from Gmail send or Calendar write. If ChatGPT requests a scope you do not want to grant, do not grant it and tell the team which feature will not work.
- Record the decision. Which app, which scopes, which units, who approved it and when it will be reviewed.
The same review is worth doing for every AI tool with a Google or Microsoft connector, because each one is a standing grant of access to company data. We cover the wider question in ChatGPT connectors and oversharing.
When to escalate to the vendor
Contact OpenAI support when the Google administrator has trusted the app for the documented scopes, the ChatGPT workspace has the connector enabled, you have disconnected and reconnected, and Google still refuses. Include the exact error text, the client ID shown, the ChatGPT plan and the time of the attempt.
Contact Google Workspace support when the app cannot be found or added in the third-party app access list, or when a trusted app is still being blocked and the audit log shows a policy you did not set.
Neither vendor can override the other's policy. If your business decided that AI tools may not read Drive, the error is the policy working. Treat that as a conversation with the owner of the policy, not a bug to route around with a personal account.