Set up SSO for your organization

You can set up SSO with Google as your service provider in a number of ways, depending on your organization’s needs. SSO profiles, which contain the settings for your IdP, give you the flexibility to apply different SSO settings to different users in your organization:

If all your users will sign in through one IdP:

  1. Follow the steps below in Configure an SSO profile for your organization.
  2. If you want to exclude some users from using SSO (and have them sign in directly to Google), follow the steps in Assign SSO profile to organizational units or groups, where you have the option to assign 'None' for SSO profile. 

If you use multiple IdPs for your users:

  1. Follow the steps below in Create SSO profiles for each of your IdPs. 
  2. Assign the SSO profiles to OUs or groups.

    If you have users within an OU (for example in a sub-OU) who don’t need SSO, you can also use assignments to turn SSO off for those users.

If your users use domain-specific service URLs to access Google services (for example, https://mail.google.com/a/yourdomain.com), you can also manage how these URLs work with SSO.

Before you begin

To set up a SAML SSO profile, you’ll need some basic configuration from your IdP’s support team or documentation:

  • Sign-in page URL  This is also known as the SSO URL or SAML 2.0 Endpoint (HTTP). This is where users sign in to your IdP.
  • Sign-out page URL (Optional)  Where the user lands after exiting the Google app or service.
  • Certificate  X.509 PEM certificate from your IdP. For more information on X.509 certificates, see SAML key and verification certificate.
  • Change password URL (Optional)  The page where SSO users will go to change their password (instead of changing their password with Google).

Configure the SSO profile for your organization

Use this option if all your users using SSO will use one IdP. 

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Security.
  3. In Third-party SSO profile for your organization, click Add SSO profile.
  4. Check the Set up SSO with third-party identity provider box.

Fill in the following information for your IdP:

  • Enter the Sign-in page URL and Sign-out page URL for your IdP.

    Note: All URLs must be entered and must use HTTPS, for example https://sso.domain.com.

  • Click Upload certificate and locate and upload the X.509 certificate supplied by your IdP. For information on generating a certificate, see SAML key and verification certificate.
  • Choose whether to use a domain-specific issuer in the SAML request from Google.

    If you have multiple domains using SSO with your IdP, use a domain-specific issuer to identify the correct domain issuing the SAML request.

    • Checked  Google sends an issuer specific to your domain: google.com/a/your_domain.com (where your_domain.com is your primary Google Workspace domain name)
    • Unchecked  Google sends the standard issuer in the SAML request: google.com
  • (Optional) To apply SSO to a set of users within specific IP address ranges, enter a network mask. For more information see Network mapping results.

    Note: you can also set up partial SSO by assigning the SSO profile to specific organizational units or groups.

  • (Optional) Enter a change password URL for your IdP. Users will go to this URL (rather than the Google change password page) to reset their passwords.

    Note: If you enter a URL here, users are directed to this page even if you don’t enable SSO for your organization.

Turn off SSO for all users

If you need to turn third-party authentication off for all your users without changing the SSO profile assignment for OUs or groups, you can disable the third-party SSO profile:

  1. Uncheck Set up SSO with third-party identity provider.
  2. Click Save.

Create an SSO profile

  1. Sign in to your Google Admin console.

    Sign in using your administrator account (does not end in @gmail.com).

  2. From the Admin console Home page, go to Security.
  3. Under Third-party SSO profiles, click Add SAML profile.
  4. Enter a name for the profile.
  5. Fill in the Sign-in page URL and other information obtained from your IdP.
  6. Click Upload certificate, then locate and upload your certificate file. For information on generating a certificate, see SAML key and verification certificate.
  7. Click Save.
  8. In the SP Details section, copy and save the Entity ID and ACS URL. You’ll need these values to configure SSO with Google in your IdP admin control panel.

Note: You can create a maximum of 1000 third-party SSO profiles.

Decide which users should use SSO

Turn SSO on for an OU or group by assigning an SSO profile and its associated IdP. Or, turn SSO off by assigning ‘None’ for the SSO profile. You can also apply a mixed SSO policy within an OU or group, for example turning SSO on for the OU as a whole, then turning it off for a sub-OU. 

  1. Click Manage SSO profile assignments.
  2. If this is your first time assigning the SSO profile, click Get started. Otherwise, click Manage.
  3. On the left, select the organizational unit or group to which you’re assigning the SSO profile.
    • If the SSO profile assignment for an OU or group differs from your domain-wide profile assignment, an override warning appears when you select that OU or group.
    • You can’t assign the SSO profile on a per-user basis. The Users view let you check the setting for a specific user.
  4. Choose an SSO profile assignment for the selected OU or group:
    • To exclude the OU or group from SSO, choose None. Users in the OU or group will sign in directly with Google.
    • To assign another IdP to the OU or group, choose Another SSO profile, then select the SSO profile from the dropdown list.
  5. Click Save.
  6. Assign SSO profiles to other OUs or groups as needed.

After you close the Manage SSO profile assignments card, you’ll see the updated assignments for OUs and groups in the Manage SSO profile assignments section. 

Manage domain-specific service URLS

The Domain-specific service URLs setting lets you control what happens when users sign in using service URLs such as https://mail.google.com/a/yourdomain.com. There are two options:

  • Redirect users to the third-party IdP. Choose this option to always route these users to the third-party IdP that you select in the SSO profile drop-down list. This can be the SSO profile for your organization, or another third-party profile (if you’ve added one).

    Important: If you have organizational units or groups that are not using SSO, don’t choose this setting. Your non-SSO users will be automatically routed to the IdP and won’t be able to sign in.

  • Require users to enter their username on Google’s sign-in page. With this option, users entering domain-specific URLs are first sent to the Google sign-in page. If they are SSO users, they’re redirected to the IdP sign-in page.

See also

Signing in with SSO

Troubleshoot SSO

Was this helpful?
How can we improve it?

Need more help?

Sign in for additional support options to quickly solve your issue

Search
Clear search
Close search
Google apps
Main menu
Search Help Center
true
73010
false