Resolving “Manager” access loops in Education Plus

In Google Workspace for Education Plus environments, faculty members, instructional coordinators, and IT staff frequently experience an access loop when managing Shared Drives. A user assigned the Manager role clicks on a Shared Drive and is met with a continuous reload loop, an immediate downgrade to read-only status, or a recurring prompt requesting that they “Ask the administrator for access.” This issue stems from conflicts between Education Plus age-based access controls, automated Student Information System (SIS) synchronization tools, and Organizational Unit (OU) policy overrides.

Quick Answer

This access loop occurs when a user’s account is placed in an OU marked as “Under 18,” when an automated SIS provisioning script (such as Google School Directory Sync or GAM) continuously overwrites the Manager role, or when licensing tiers conflict. Move the user to a verified staff OU and adjust external sharing policies.

---

Anatomy of the Education Plus Access Loop

Google Workspace for Education Plus enforces strict compliance mechanisms under the Family Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Act (COPPA). When an account attempts to exercise managerial control over a Shared Drive, the platform validates multiple security controls simultaneously:

Education Plus Validation Sequence:
[User Accesses Shared Drive as Manager]
                   │
                   ▼
[Check 1: Age-Based Access Setting] ──> Marked "Under 18"? ──> ACCESS STRIPPED (Loop Triggered)
                   │ (Marked 18 or Older)
                   ▼
[Check 2: SIS Sync / Automation]   ──> Script demotes user? ──> ROLE OVERWRITTEN (Loop Triggered)
                   │ (Stable Provisioning)
                   ▼
[Check 3: Shared Drive Policies]   ──> External sharing block? ──> Bounced to "Request Access"
                   │ (Compliant)
                   ▼
[Manager Access Granted Successfully]

If any check fails dynamically while the Google Drive interface loads, the web client enters a state mismatch, bouncing the user between permissions screens.

---

Primary Causes in Education Environments

1. Age-Based Access Settings (“Under 18” Tagging)

Google requires all Education domains to identify users as either “18 or older” or “Under 18”:

• Users designated as “Under 18” face automated platform restrictions, including strict limitations on Shared Drive management, external link generation, and administrative controls.
• If a teacher, adjunct instructor, or staff member is placed in a student OU or an unconfigured top-level OU where default age status is “Under 18,” their Manager rights are revoked by the safety engine upon session validation, creating an access loop.

2. Automated Sync Tool Overwrites (GSDS, Clever, GAM)

Most school districts use automated synchronization utilities (such as Google Cloud Directory Sync, Clever, OneRoster, or scheduled GAM cron scripts) to manage rosters and directory groups:

• A school administrator manually grants a teacher the Manager role on a curriculum Shared Drive.
• Within 15 to 60 minutes, the automated sync script runs. The script evaluates the drive against SIS records, determines that the user is not an official owner in the database, and downgrades them back to Contributor or removes them.
• The user reports that their management access “mysteriously disappears” every day.

3. Student vs. Staff License Mismatches

Education Plus tenants manage two pools of licenses: Education Plus for Staff and Education Plus for Students:

• Staff licenses provide unrestricted access to administrative Shared Drive workflows.
• Student licenses apply strict collaboration ceilings.
• If an instructional coach or teaching assistant is mistakenly assigned a student license, role assignments conflict with backend licensing limits.

---

Diagnostic and Resolution Steps

Step 1: Audit and Update Age-Based Access Controls

Confirm that the affected user is explicitly verified as an adult:

1. Sign in to the Google Admin Console.
2. Go to Account > Account settings > Age-based access settings.
3. In the left panel, select the Organizational Unit containing the affected user (e.g., /Staff or /Faculty).
4. Ensure the setting is toggled to Some or all users are 18 or older, and confirm that the user’s specific sub-OU is checked as 18 or older.
5. Save any changes. Changes can take several hours to propagate across all Google services.

Step 2: Audit Directory Sync Configuration

If the access loop recurs periodically:

1. Inspect your automated sync logs (e.g., Google Cloud Directory Sync or GAM execution logs).
2. Search for the user’s email address and the Shared Drive ID.
3. Check whether the sync engine is configured to enforce an explicit Access Control List (ACL) on Shared Drives.
4. If the sync tool manages permissions, update the source directory (Active Directory, Azure AD, or SIS) rather than making manual changes in the Google Drive UI.

Step 3: Validate License Assignment

1. In the Admin Console, go to Directory > Users.
2. Click the affected user.
3. Under the Licenses section, verify that the account is assigned Google Workspace for Education Plus – Staff, not the student variant.
4. If the license is incorrect, reassign it to the staff tier.

---

Interacting with Shared Drive Settings

Once the user’s OU and licensing are aligned:

• Check whether the Shared Drive contains restricted subfolders causing inheritance conflicts using Fixing Permission Inheritance Issues in Shared Subfolders.
• Confirm that the drive does not violate external sharing boundaries as detailed in Why Shared Drive External Sharing is Blocked and Troubleshooting Cross-Domain Shared Drive Access Errors.
• If the user still experiences access denials, confirm their assigned role using Fix: “Access Denied” on Shared Drive (Even for Managers) and Fix: “Manager” vs. “Content Manager” Conflict.