Resolve Google Admin Console restore error: Access Policy Already Exists

 What this error means

The organization already has the single access-policy container permitted by Google.

 Why this error occurs

Google allows one Context-Aware Access policy per organization. The policy itself holds no settings — the access levels inside it carry the conditions you configure — so a second one cannot be created, and the destination already has the one it is allowed. 

Your access levels can still be restored. They go into the policy the organization already has. 

 Resolution

1. Leave the existing Context-Aware Access policy in place.
2. In SysCloud, exclude the access-policy object from the restore selection.
3. Restore the backed-up access levels. They are added to the existing policy.

Do not delete the existing policy to make room for the backed-up one. Deleting it also removes every access level inside it and the app assignments that depend on them, which changes who can access your applications straight away. Restoring the access levels into the existing policy achieves the same result without that risk. 

 Verify the resolution

In the Google Admin console, go to Menu > Security > Access and data control > Context-Aware Access and confirm the restored access levels appear with the expected conditions. Check the app assignments for those access levels if the restore was meant to reapply them. 

 If the error continues

Confirm that the access-policy object was excluded and that only access levels were selected for the restore. If the error continues, contact SysCloud Support with the error code, job ID, affected object, raw Google error message, and time of failure.