Google Drive and Gmail: account and sign-in errors
Errors when adding a Google account to O365 Migration (service account key, OAuth client, refresh token) and what each means.
| Message | Fix |
|---|---|
| This is not a service account key. | Google Cloud console → IAM & Admin → Service accounts → your account → Keys → Add key → Create new key → JSON. |
| This OAuth client is a "Web application". | Create an OAuth client ID of type Desktop app and download its JSON. |
| This is not an OAuth client file. | You chose another JSON file. Download the JSON of the Desktop app OAuth client. |
| Google did not return a refresh token. | Remove the app at myaccount.google.com → Security → Third-party access, then sign in again. |
| … is signed in as … and can only migrate that mailbox | A personal (OAuth) sign-in only reaches its own Drive and mailbox. To migrate other users, use a Workspace service account with domain-wide delegation. |
| unauthorized_client when testing a service account | Domain-wide delegation is missing or lacks scopes. Google Admin console → Security → API controls → Domain-wide delegation → add the service account's client ID with the scopes shown in the app. Allow a few minutes. |
| 429 or rate limit exceeded | Google throttling – retried automatically. Lower the Run … at a time number for very large migrations. |
Setup step by step: Import from Google Drive and Gmail to Exchange Online.
Was this article helpful?
Updated 2026-10-26