Set up SSO for your organization

You can set up SSO with Google as your service provider in a number of ways, depending on your organization’s needs. SSO profiles, which contain the settings for your IdP, give you the flexibility to apply different SSO settings to different users in your organization.

Workplace supports both SAML-based and OIDC-based SSO protocols:

If all your users will sign in through one IdP, using SAML

  1. Follow the steps below in Configure an SSO profile for your organization.
  2. If you want to exclude some users from using SSO (and have them sign in directly to Google), follow the steps in Decide which users should use SSO, where you have the option to assign 'None' for SSO profile. 

If you use multiple IdPs for your users, or use OIDC:

The steps you follow depend on the protocol used by your IdP (SAML or OIDC):

If your users use domain-specific service URLs to access Google services (for example, https://mail.google.com/a/yourdomain.com), you can also manage how these URLs work with SSO.

Before you begin

To set up a SAML SSO profile, you’ll need some basic configuration from your IdP’s support team or documentation:

  • Sign-in page URL  This is also known as the SSO URL or SAML 2.0 Endpoint (HTTP). This is where users sign in to your IdP.
  • Sign-out page URL (Optional)  Where the user lands after exiting the Google app or service.
  • Certificate  X.509 PEM certificate from your IdP. For more information on X.509 certificates, see SAML key and verification certificate.
  • Change password URL (Optional)  The page where SSO users will go to change their password (instead of changing their password with Google).

Configure the SSO profile for your organization

Use this option if all your users using SSO will use one IdP. 

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2.  In the Admin console, go to Menu ""and then"" Securityand thenOverview.
  3. In Third-party SSO profile for your organization, click Add SSO profile.
  4. Check the Set up SSO with third-party identity provider box.

Fill in the following information for your IdP:

  • Enter the Sign-in page URL and Sign-out page URL for your IdP.

    Note: All URLs must be entered and must use HTTPS, for example https://sso.domain.com.

  • Click Upload certificate and locate and upload the X.509 certificate supplied by your IdP. For information on generating a certificate, see SAML key and verification certificate.
  • Choose whether to use a domain-specific issuer in the SAML request from Google.

    If you have multiple domains using SSO with your IdP, use a domain-specific issuer to identify the correct domain issuing the SAML request.

    • Checked  Google sends an issuer specific to your domain: google.com/a/your_domain.com (where your_domain.com is your primary Google Workspace domain name)
    • Unchecked  Google sends the standard issuer in the SAML request: google.com
  • (Optional) To apply SSO to a set of users within specific IP address ranges, enter a network mask. For more information see Network mapping results.

    Note: you can also set up partial SSO by assigning the SSO profile to specific organizational units or groups.

  • (Optional) Enter a change password URL for your IdP. Users will go to this URL (rather than the Google change password page) to reset their passwords.

    Note: If you enter a URL here, users are directed to this page even if you don’t enable SSO for your organization.

Turn off SSO for all users

If you need to turn third-party authentication off for all your users without changing the SSO profile assignment for OUs or groups, you can disable the third-party SSO profile:

  1. Uncheck Set up SSO with third-party identity provider.
  2. Click Save.

Create an SSO profile

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2.  In the Admin console, go to Menu ""and then"" Securityand thenOverview.
  3. Under Third-party SSO profiles, click Add SAML profile.
  4. Enter a name for the profile.
  5. Fill in the Sign-in page URL and other information obtained from your IdP.
  6. Click Upload certificate, then locate and upload your certificate file. For information on generating a certificate, see SAML key and verification certificate.
  7. Click Save.
  8. In the SP Details section, copy and save the Entity ID and ACS URL. You’ll need these values to configure SSO with Google in your IdP admin control panel.

Note: You can create a maximum of 1000 third-party SSO profiles.

Decide which users should use SSO

Turn SSO on for an OU or group by assigning an SSO profile and its associated IdP. Or, turn SSO off by assigning ‘None’ for the SSO profile. You can also apply a mixed SSO policy within an OU or group, for example turning SSO on for the OU as a whole, then turning it off for a sub-OU. 

  1. Click Manage SSO profile assignments.
  2. If this is your first time assigning the SSO profile, click Get started. Otherwise, click Manage.
  3. On the left, select the organizational unit or group to which you’re assigning the SSO profile.
    • If the SSO profile assignment for an OU or group differs from your domain-wide profile assignment, an override warning appears when you select that OU or group.
    • You can’t assign the SSO profile on a per-user basis. The Users view let you check the setting for a specific user.
  4. Choose an SSO profile assignment for the selected OU or group:
    • To exclude the OU or group from SSO, choose None. Users in the OU or group will sign in directly with Google.
    • To assign another IdP to the OU or group, choose Another SSO profile, then select the SSO profile from the dropdown list.
  5. (Microsoft OIDC SSO profile only) Enter your Microsoft account password and click Sign in to verify your Microsoft SSO configuration.

    If you're an Azure AD organization admin, you have the option to accept consent on behalf of the organization. This means that end-users will not be prompted to provide OAuth consent.

  6. Click Save.
  7. Assign SSO profiles to other OUs or groups as needed.

After you close the Manage SSO profile assignments card, you’ll see the updated assignments for OUs and groups in the Manage SSO profile assignments section. 

Manage domain-specific service URLS

The Domain-specific service URLs setting lets you control what happens when users sign in using service URLs such as https://mail.google.com/a/yourdomain.com. There are two options:

  • Redirect users to the third-party IdP. Choose this option to always route these users to the third-party IdP that you select in the SSO profile drop-down list. This can be the SSO profile for your organization, or another third-party profile (if you’ve added one).

    Important: If you have organizational units or groups that are not using SSO, don’t choose this setting. Your non-SSO users will be automatically routed to the IdP and won’t be able to sign in.

  • Require users to enter their username on Google’s sign-in page. With this option, users entering domain-specific URLs are first sent to the Google sign-in page. If they are SSO users, they’re redirected to the IdP sign-in page.

See also

Signing in with SSO

Troubleshoot SSO

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

true
Start your free 14-day trial today

Professional email, online storage, shared calendars, video meetings and more. Start your free Google Workspace trial today.

Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
73010
false
false