How to Resolve Error 400 admin_policy_enforced When Connecting Creatio (bpm’online) to Your Google G Suite Email or Calendar

If your organization uses G Suite and Creatio and you’ve just started getting an “Error 400: admin_policy_enforced” error when attempting to connect, or reconnect, your Gmail or Calendar to Creatio, this is due to a Google policy change that went into effect on November 4th, 2019. The error you see when you connect/reconnect your account is the following:

Here’s what’s happened. On November 4th Google made a change requiring any third-party app that requests admin permissions to be explicitly marked as trusted. Prior to November 4th, this wasn’t necessary, so you could connect Creatio to G Suite, thereby adding the app, and it would just immediately work. Apparently, Creatio’s Google integration, likely incorrectly, requests admin API permissions. So, in order for it to work, you have to go into the G Suite Admin console and explicitly flag it as “trusted”. Whether Creatio actually requests admin API access intentionally or not is another topic, however, it could be that it is used to grant OAuth tokens to the users in the G Suite organization.

How to Fix

So, here’s how to fix this. The G Suite administrator needs to go into the Google Admin console, then access the following:

• Security > Settings > API Permissions

Once there, you’ll see the “bpm’online social” app listed:

Click the 3-dot icon on the far right, then select “Trust” from the menu and it should immediately start working again. If you need more help, Google has this video showing the steps.