Google OAuth Consent - Internal - Multiple separate organisations

Question

I'm trying to setup a Google OAuth consent screen but I have two separate google workspace accounts. The two accounts are completely separate.

I have the consent screen setup, working perfectly for the one workspace "domain-a.com" as an Internal User Type to make sure only users within "domain-a.com" can login.

I'd like to also allow "domain-b.com" accounts from the other google workspace to also be able to login.

I'm wondering if this is at all possible? Or is my only option to set the User Type to external and then vet the domains in my auth flow?

I was hoping it would possible to somehow authorise "domain-b.com" on the "domain-a.com" workspace without adding all the additional domain aliases to users etc? I do see the Domain Verification option under the APIs and Services screen, but this only mentions webhooks.

Any help would be appreciated

Answer 1

I think setting the type to external is the only way to achieve this.

Does your app use any sensitive scopes ? If so, then setting the app to external means that your app might require verification unless you mark the app as trusted in both Workspace accounts .