Troubleshooting problems with the Afi application installation¶
This article addresses problems that you might encounter with Afi SaaS backup for Google Workspace and how to resolve them.
Onboarding a Google Workspace tenant¶
The Afi application installation from the Google Workspace Marketplace and Google Workspace tenant onboarding is described in the following guide. Once the Afi application is installed, it may take up to 24 hours before access rights are propagated on the Google Workspace side and the application is able to access your Google Workspace tenant. During this time, the Afi onboarding wizard will show the following message - After application is installed it may take up to 24 hours before access is granted to the application. This page will be automatically refreshed to check the access.
If the onboarding wizard does not proceed after 24 hours for any reason, please follow the instructions below to verify that the Afi application is properly installed and has the required access to your tenant.
Check that the Afi application is installed in the Google Workspace Marketplace¶
You can check if the Afi application is installed on the Afi page in the Google Workspace Marketplace. If you don't see the Admin install button and the Install button is disabled, then your current Google account is not a Google Workspace Super Admin, so please check the account that you are using and its roles on the Google Workspace side.
Check the Afi application installation scope¶
The Afi application should be installed for all users that you want to back up with Afi and for at least one Google Workspace Super Admin (in case of an onboarding it should be the same user who is performing the onboarding). Without a Super Admin access, the Afi application can't perform a Google Workspace tenant onboarding and the onboarding wizard will continue to show the 1st step, asking to install the application.
In general, we advise to install the Afi application for the entire Google Workspace tenant and not only for specific organizational units/Google groups. Otherwise, if certain users or Google Workspace Super Admins are moved to organizational units or Google groups that the Afi application cannot access, the application will not be able to back up these users or perform periodic resource synchronizations with Google Workspace.
You can check the Afi application installation scope and enable the Afi application for the entire tenant or for the specific organizational units/Google groups on the Apps → Google Workspace Marketplace apps → Apps list → Afi G Suite Backup page.
Re-install the Afi application to trigger access rights propagation¶
If the previous steps didn't help, you can uninstall the Afi application and install it again. This triggers Google Workspace access rights propagation and should help if previous steps didn't work.
a. To uninstall Afi go to Apps → Google Workspace Marketplace apps -> Apps list, then select the application name.
b. Uninstall the application by clicking on the bucket icon, then install it again from the Marketplace.
Info
Uninstalling the Afi application from a Google Workspace tenant does not affect the existing backups in the corresponding tenant on the Afi side. If the Afi application is uninstalled, your Afi account will remain accessible, and the existing backups will still be available for browsing and export. However, future backups will fail with the Not authorized status until the application is reinstalled.
Google Drive API enabled¶
Due to Google API specifics, Afi impersonates under a Google Workspace Super Admin user to perform an initial resources discovery during a Google Workspace tenant onboarding and requires Google Drive access for the tenant to discover the Shared drives. You can check if Google Drive API access is enabled for the tenant or specific users in the Google Workspace Admin panel in the Apps → Google Workspace → Settings for Drive and Docs → Service status section.
Backup and recovery¶
The Afi application requires access to all Google Workspace users that you want to back up and where you want to restore the data. Backup or restore tasks for users for which the Afi application isn't installed will fail with the Not authorized status. Please see the section above on how to check and grant the access.
Info
In rare cases it can take up to 24 hours until an initial synchronization with Google Workspace is completed and all users and drives become visible and accessible for the application. During this time you can observe a small amount of backups failing with the Not authorized status even if the Afi application is installed for the corresponding users.
Other backup and recovery issues as well as the troubleshooting steps are described in the following guide.
Suspended or long running backups¶
In rare cases during an initial backup for a Google Workspace tenant (in particular, a large one) you can observe some backup tasks temporarily suspended with the Paused status. This is a normal service behaviour implemented to handle elevated spikes of API limit-related or transient errors from the Google API and handle Google API throttling gracefully. Paused backups are restarted automatically in a few hours and proceed from the saved state.
Afi continuously monitors paused or long-running tasks and proactively resolves any issues that prevent them from completion.
Resource synchronization with Google Workspace¶
The Afi application needs access to at least one active Google Workspace Super Admin account throughout its lifecycle to perform resource synchronizations with Google Workspace. While the application is not connected to any specific Super Admin account and selects an arbitrary available Super Admin account that it can access, to perform synchronizations, the application relies on a list of Super Admin accounts saved during the previous synchronization to select an account.
For this reason, if you have a single Google Workspace Super Admin account in your tenant and want to replace it, please create/promote a new Super Admin account, trigger a resource synchronization on the Afi side by clicking on the refresh icon in the top-right corner of the Service → Protection screen before deleting/demoting the old Super Admin account and, after the synchronization is finished successfully, you can delete/demote the old Super Admin. Resource synchronization task status can be checked on the Activity → Tasks tab.
If periodic resource synchronizations (Discovery) tasks fail with the Not authorized status code for a Google Workspace tenant, please check the Afi application installation scope or contact the Afi Support to replace a deleted Google Workspace Super Admin account used for resource synchronizations with a new one.