How to Set Up Google SSO in Your Organization

Google Single Sign-On (SSO) lets users access multiple applications and services with their Google account—no need to manage separate passwords. You can integrate Google SSO to streamline user access and enhance security across your organization.

Setting up the Google Workspace Custom SAML App

Before setting up Google SSO in your organization, you’ll need to create a custom SAML app in your Google Workspace dashboard. To get going, here’s what you’ll do:

1. Log in to your Google Workspace Admin Console, then in the menu on the left, click on Apps.
2. Now, in the menu that comes up, click on Web and Mobile Apps.
3. In the Web and Mobile Apps section on the right, click on Add App.
4. Then, in the Dropdown menu that opens, click on Add Custom SAML App.

5. On the Add Custom SAML App screen, under the App Details section, set up these things:
   • App Name — Choose a name that’s easy to recognize and helps identify your app at a glance.
   • Description — Provide a short description to explain what your custom SAML app’s for.
   • App Icon — Upload an icon to help visually identify your custom app.
6. Then, click on Continue in the bottom-right corner of the screen.

7. On the Google Identity Provider Details screen, copy your Custom SAML App’s SSO URL, Entity ID, and Certificate.
8. Then, click on Continue in the bottom-right corner of the page.

9. On the Service Provider Details screen, fill in these details.
   • ACS URL — Enter your full Assertion Consumer Service URL. For example: https://example.yourorganization.com/sso/?acs
   • Entity ID — Provide your organization’s Entity ID. For example: https://example.yourorganization.com/sso/metadata.php

10. Next, click on Continue in the bottom-right corner of the page.

11. Now, on the Attribute Mapping screen, click on Finish.

12. Then, on the newly created Custom SAML App, under the User Access section, click on OFF for Everyone.

13. Finally, in the Service Status section, select ON for Everyone, click on Save, and you’re all set. 

Enabling and Configuring Google SSO in Your Organization

Now that you’ve got your Custom SAML App details ready, log in to your account to set up the SSO connection. Here’s how to get going:

1. On your My Workspace page, click on your Avatar/Profile picture in the top-right corner of the screen.
2. Then, in the Dropdown menu that comes up, click on Admin Console to open your Admin Dashboard page.

3. In the left menu, click on Security.

3. Scroll down to the SSO Settings section and select Add SSO Provider.

3. Select Configure Manually.

3. Then, in the Provider Name field, enter the name you want users to see on the login page.

6. Now, in the Identity Provider Metadata section, fill in these details:
   • Entity ID — Enter your Google SAML Entity ID.
   • SSO URL — Enter your Google SAML SSO URL.
   • Certificate — Paste your Google SAML Certificate.
   • SLO URL — Leave this blank*.

7. Finally, click on Test Connection to make sure everything’s working correctly. If it’s successful, click on Save Configuration to apply your SSO settings—and you’re good to go.

Once you’ve turned on SSO, you’ll see these extra options under the SSO settings:

• Allow Email Login for Licensed Users — This lets licensed users log in with their email and password too, not just through SSO.
• Require Single Sign-On for Guest Accounts — This makes sure guest users can only sign in through SSO, adding a bit more security.
• SSO SCIM Provisioning Settings — This helps you automatically manage users by syncing with your identity provider, so you don’t have to update things manually.
• Just-In-Time (JIT) Access — This allows users to request temporary, time-limited access to restricted systems only when needed. It helps maintain security by granting elevated permissions on demand and automatically revoking them once the approved period ends.