Google Workspace blocked the Grok Bot connection

Confirm the message

Use this fix if the Gmail, Calendar or Drive connection shows one of these messages:

• "Your admin has not approved this app"
• "This app is blocked"
• an unverified-app warning that your organisation does not allow you to continue past

If the connection succeeds but the Bot cannot see a mailbox, calendar or folder, check sharing and scopes instead.

Why it happens

Google Workspace administrators can restrict which third-party OAuth clients may access company data. Grok Bot or its connector has requested access that the organisation has not approved.

Do not turn off the organisation's app controls. Approve the specific connection for a dedicated Bot user and only for the work it needs to do.

Before the administrator changes anything

Collect these details from the failed connection:

1. The connector name shown on the consent screen.
2. Its OAuth client ID, if the screen or connector documentation provides one.
3. The Google scopes it requests.
4. The exact user account that will run the connection.
5. The mailbox, calendar or Drive folder the workflow needs.

The administrator needs the connector identity and requested scopes. A screenshot of the error alone is not enough to approve the right client.

Fix the connection

1. Create a dedicated Google user

Use an address such as ops-bot@yourdomain. Put Bot users in a separate organisational unit if the Workspace structure supports it.

Do not connect the owner's personal account or make the Bot a super administrator.

2. Review the connector in Google Admin

In Google Admin, open Security, then API controls, then App access control. Find or add the connector by its OAuth client ID.

Review the requested Google data and allow only what the first workflow needs. Apply the access to the Bot user or its organisational unit where the policy supports that scope.

3. Share only the required source

Give the Bot user access to the specific shared mailbox, calendar or Drive folder. The account does not need access to unrelated executive email or personal files.

4. Reconnect as the Bot user

Sign out of any personal Google account in the connection window. Start the connection again and confirm that the consent screen names the dedicated Bot user.

5. Run a read-only test

For Gmail, read one supplied thread and prepare a draft without sending it. For Calendar, read one supplied event without changing it. For Drive, summarize one shared file without opening other folders.

Copy this Gmail test

Read the one Gmail thread I provide through the approved connection. Return the sender, subject, latest message, requested action and a draft reply. Link the source thread. Do not send, archive, label, forward or open any other message. Stop after the draft.

Verify the fix

The connection is ready only when:

• the consent flow completes as the dedicated Bot user;
• the Bot can read the one approved source;
• it cannot see an unrelated source;
• the test causes no send, file change or calendar change;
• the administrator has recorded the connector and scopes that were approved.

The access token is available on the shared computer, so dedicated identity and narrow sharing matter even after the consent error is gone.

Grok Bot + Google Workspace · Grok Bot + Gmail