title: Google Project with consent set to internal / Who is a "member of my organization" and how do I manage members?
body: <p><em>Disclaimer: <a href="https://console.cloud.google.com/support/community" rel="noreferrer">https://console.cloud.google.com/support/community</a> leads here. Google's documentation is horrific so giving this a whirl on the off chance that I don't get downvoted to the depths of dev/null</em></p>
  
  <p>Out of impending necessity I am migrating a private application that monitors our Gmail accts to OAuth 2, and as part of this process it was necessary to create an <em>OAuth consent screen</em>. Since this application will only be used internally it makes the most sense to choose "<em>Internal</em>" for Application Type - which is described as follows:</p>
  
  <blockquote>
    <p>Only users with a Google Account in your organization can grant access to the scopes requested by this app.</p>
  </blockquote>
  
  <p>The users on this Project consist of two "owners" — myself using my personal Gmail acct, and
  another employee who is part of the company G Suite account.</p>
  
  <p>My question is <strong><em>who</em></strong> qualifies as a "<em>user in my organization</em>"? Is this based on the project owners? Does my non-G-Suite account (which is an owner of the project) qualify? Does the inclusion of one member in a G Suite account automatically associated the other employee accounts? Is the anywhere to actually see these users or manage them directly?</p>
  
  <p>I'd actually like to add another couple accounts to the mix but still keep the application private, but I'm confused about how Google determines which gmail accounts will be able to authorize the app.</p>
  
  <p><strong>UPDATE:</strong> To clarify, when I visit the consent page while logged in as a member of our G Suite on the same domain as the project owner, everything is fine.  However, we have other members managed in the same G Suite account who are under a different domain and for these I get the message:</p>
  
  <blockquote>
    <p><strong>Error 403: org_internal</strong>
    This client is restricted to users within its organization.</p>
  </blockquote>
  
  <p>Furthermore, I am not even able to grant access using <strong><em>my own email which is the creator and owner of the application</em></strong>. I'd like to know how I can add myself and the other G Suite members to be able to grant access to the application without making it public. It was suggested below that I add them (or their domain) to Google Cloud IAM but I'm unclear about how to get this working. My own email does already exist in IAM with role of "owner" and apparently that doesn't satisfy the requirement. </p>