Troubleshoot the Google Drive Audit Logs connector

Beta

This feature is in Beta. Workspace admins can control access to this feature from the Previews page. See Manage Databricks previews.

This page describes common errors you might encounter with the managed Google Drive Audit Logs connector and how to resolve them.

For general troubleshooting guidance that applies to all managed ingestion pipelines, see Troubleshoot managed ingestion pipelines.

Token minting fails with unauthorized_client

Cause: The scope requested for the minted token doesn't match the scope authorized for the service account's client ID in Manage Domain-Wide Delegation. Google rejects token minting with unauthorized_client.

Solution:

1. In the Google Workspace Admin console, go to Security > Access and data control > API controls > Manage Domain Wide Delegation.
2. Confirm that the service account's client ID is authorized for the https://www.googleapis.com/auth/admin.reports.audit.readonly scope.
3. Confirm that the Service Account JSON Key in the Unity Catalog connection belongs to the same service account.

For details, see Configure authentication to Google Workspace.

Pipeline fails to authenticate

Cause: Google Workspace returned an HTTP 403 response that isn't a rate-limit response. This usually means the impersonated admin lacks the Reports privilege, or domain-wide delegation isn't configured for the service account. The connector treats this as a configuration error and fails the pipeline.

Solution:

1. Confirm that the Admin Email to Impersonate in the Unity Catalog connection is an admin account with the Reports privilege.
2. Confirm that domain-wide delegation is authorized for the service account's client ID with the audit-readonly scope.

For details, see Configure authentication to Google Workspace.

Google Workspace API rate limit exceeded

Cause: Google Workspace returned an HTTP 429 response, or an HTTP 403 response with a rateLimitExceeded or userRateLimitExceeded reason, because the connector sent too many requests in a short period.

Solution:

The connector honors the Retry-After response header, then falls back to exponential backoff and retries automatically. If this happens repeatedly, reduce the pipeline's schedule frequency or the number of concurrent pipelines that share the same Google Workspace account.

Google Workspace API temporarily unavailable

Cause: Google Workspace returned a transient server error (HTTP 500, 502, 503, or 504).

Solution:

The connector automatically retries with exponential backoff. If the issue persists, wait, then run the pipeline again.