The sign-in page for the Admin console is admin.google.com, which redirects to accounts.google.com, while the sign-in page for an individual Google service is service.google.com/a/example.com. When you configure SSO for your domain, the behavior of these pages depends on whether the user signing in has super administrator privileges, and whether the domain has a network mask.
Signing in with super administrator privileges
Admin console
When super administrators try to sign in to an SSO-enabled domain via admin.google.com, they must enter their full Google administrator account email address and associated Google password (not their SSO username and password), and click Sign in to directly access the Admin console. Google does not redirect them to the SSO sign-in page.
Google Drive synchronization client
When super administrators sign in to the Google Drive synchronization client, they bypass SSO—Google does not redirect them to the SSO sign-in page. This applies to sign-in attempts from browsers, mobile apps (such as the iOS Drive and Gmail apps), the Android account activation flow, and so forth.
Google services using a domain-specific URL
As super admin, you can sign into a Google service with a domain-specific URL (such as mail.google.com/a/example.com) using SSO, if:
- Your domain is using the Third-party SSO profile for your organization. Also, if your domain uses a network mask, you must be within the network mask.
- The Domain-specific Service URLs setting is set to Automatically redirect users to the third party IDP, and the SSO profile is set to SSO profile for your organization.
If you’re using another SSO profile (not the SSO profile for your organization), super admin sign-in to domain-specific URLs via your IdP is not supported. If the Domain-specific service URLs setting is set to automatically redirect users to that SSO profile, signing into a domain-specific URL will result in a login error.