How to Connect a Third-Party Single Sign-on to Google Workspace

Quick and easy-to-follow guide for Google Workspace administrators

What is SSO

With SSO (Single Sign-On), you can set up a third-party service as an identity provider for your Google Workspace accounts.
You can learn about SSO here.

How SSO works

When you configure SSO with a third-party identity provider, your Google Workspace users sign in to their accounts using login credentials set up at the SSO service.
When a user in your domain types their email on the Google sign-in page, they get redirected to another page to complete the login through the third-party identity provider.
For example, let’s say you’ve set up Microsoft Office 365 as your SSO provider. Your users must use their Microsoft account credentials to sign in to their Google Workspace accounts.

Google Workspace Super Admins and SSO

Super Admins always bypass this configuration.
They can only sign in with their Google Workspace credentials and never get redirected to the SSO login page.

POP/IMAP and SSO

When you have SSO and want to connect a desktop app (or POP/IMAP access to Gmail) to your Google Workspace account, you need to authenticate with the username and password set up via the Admin console.

How to use a third-party SSO provider for Google Workspace step-by-step with images

Step 1

In the Google Admin console at https://admin.google.com, click the Security icon.

Step 2

Select Set up single sign-on (SSO) with a third party IdP.

Step 3

Click ADD SSO PROFILE.

Step 4

To start setting up SSO, check the Set up SSO with third-party identity provider box. Then fill in the required information below.

Sign-in page URL: users get redirected to this page to sign in through the SSO into their Google account.

Sign-out page URL: the page where users are redirected when their sign-in is complete.

You need to get these details from your third-party SSO provider.

Step 5

Verification certificate: Upload a verification certificate received from the SSO provider here. The certificate must be a X.509-formatted certificate with an embedded public key.

Check the Use a domain-specific issuer box to enable a domain-specific issuer. If you enable this, Google sends an issuer specific to your domain, google.com/a/yourdomain.com, where yourdomain.com is replaced with your actual domain name. If you don’t check the box to enable a domain-specific issuer when you set up SSO, Google sends the standard issuer, google.com, in the SAML request.

The Network masks setting allows you to specify any network IP addresses where users are allowed to sign in. Users trying to sign in from any IPs not listed here will not be able to access their accounts.

Step 6

Click SAVE. It may take some time to start working.

If you add a URL (website address) in the Change password URL field, all users (excluding Super Admins) who try to change their password at https://myaccount.google.com/ will get redirected to your URL. This setting applies even if you do not enable SSO.