---
locale: "en"
updated_at: "2026-06-25T08:14:10.960Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/guides/sso/configure-the-applications/google-workspace"
---

# Configure Google Workspace for UserLock SSO

Configure UserLock SSO integration for Google Workspace.

## Introduction

This guide explains how to integrate **Google Workspace** with **UserLock Single Sign-On (SSO)** using the SAML 2.0 protocol.

Once configured, Google Workspace logins are authenticated by UserLock against Active Directory. This provides a seamless sign-in experience and allows administrators to enforce UserLock [access policies](/userlock/docs/reference/core-concepts/access-policies) (MFA, time, machine, or location restrictions) to SSO sessions.

🚩 **Before starting:**

- You need a **Google Workspace account** with super-administrator rights.
- **UserLock SSO** must already be [installed and configured](/userlock/docs/guides/sso/install-configure-sso).

## Step 1. Configure Google Workspace for Single Sign-On

1. Log into the Google Admin console at [https://admin.google.com](https://admin.google.com).
2. Go to **Security ▸ Authentication ▸ SSO with third party IdP**.

![](https://a.storyblok.com/f/122374/251x583/36345b3fdc/google-workspace-1-sso-configuration.png)

### Option A. Apply SSO globally

1. In **Third-party SSO for your organization**, check **Set up SSO with third-party identity provider**.
2. Fill the fields with your UserLock SSO values:
  | Settings | Values |
  | --- | --- |
  | Sign-in page URL | `https://sso.<yourdomain>.com/saml/sso` |
  | Sign-out page URL | `https://sso.<yourdomain>.com/connect/endsession` |
  | Verification certificate | 1. Go to *UserLock console▸* *Server Settings▸ Single Sign-On* 2. Click on *Download  ▸ SAML certificate*. 3. Open it in a text editor, and paste the contents here   ![](https://a.storyblok.com/f/122374/677x120/18879ee065/adobesign-certificate.png) |
3. (Recommended) Enable **Use a domain-specific issuer**.

![](https://a.storyblok.com/f/122374/849x645/31c36d389e/google-workspace-2-use-domain-specific-issuer.png)

### Option B. Apply SSO by OU or Group

1. In **Third-party profiles**, click **ADD SAML PROFILE**.
2. Define the **Entity ID**, **Sign-in page URL**, **Sign-out page URL**, and upload the UserLock certificate.
3. Save the profile.

![](https://a.storyblok.com/f/122374/654x959/c351c15ca5/google-workspace-3-add-saml-profile.png)

![](https://a.storyblok.com/f/122374/692x484/ad20eb2994/google-workspace-6-applying-specific-ou-group-google-workspace.png)

### Assign the SSO profile

1. Go to **Manage SSO profile assignments**.
2. Choose the desired option:
  - **Organization's third-party SSO profile** (global application).
  - **Another SSO profile** (OU- or Group-based).
  - **None** (SSO disabled, users sign in with Google credentials).

![](https://a.storyblok.com/f/122374/1159x771/8df8afd2f3/google-workspace-5-configure-sso-profile-assignment.png)

## Step 2. Activate Google Workspace in UserLock

In the UserLock console, go to ⚙** Server settings ▸ Single Sign-On**.

### If applied globally

1. Click on the **Google row**.
2. Fill the fields:
  | Settings | Values |
  | --- | --- |
  | Email Domain | Domain used for Google Workspace logins. |
  | Émetteur | Your Google Workspace instance domain (e.g. `google.com/a/sso.mydomain`). |
  | ACS URL | e.g. `https://google.com/a/sso.mydomain/acs`. |

![](https://a.storyblok.com/f/122374/638x787/43e476f66c/google-workspace-global-settings.PNG)

### If applied to OU/Group profiles

1. From the **Google Admin console**, copy the **Entity ID** and **ACS URL** from the **SP details** of the chosen SSO profile.
  ![](https://a.storyblok.com/f/122374/739x476/5bbd67ee60/google-workspace-4-add-saml-profile.png)
2. Paste them into UserLock.
  ![](https://a.storyblok.com/f/122374/638x787/43e476f66c/google-workspace-global-settings.PNG)

## Troubleshooting

For common issues, see [Troubleshooting SSO](/userlock/docs/support/troubleshooting/sso-issues).
If the problem persists, please contact [IS Decisions Support](/support).

### Handling SSO unavailability  

SSO can be disabled in emergencies. **Super-administrators can always log in **with their full Google admin email address and password.

To disable SSO in Google Workspace:

1. Log into the **Google Admin console** at [https://admin.google.com](https://admin.google.com).
2. Go to **Security ▸ Authentication ▸ SSO with third party IdP**.
3. In **Manage SSO profile assignments**, select **None**.
  - Users will then sign in with their regular Google credentials.

## Next steps

You can extend the security of SSO sessions by applying UserLock access policies in addition to authentication.

- [Apply MFA on SaaS connections](/userlock/docs/guides/mfa-implementation/mfa-for-sso) to require stronger authentication.
- [Hour restrictions](/userlock/docs/reference/access-policies/time-restriction): define when users are allowed to connect.
- [Geolocation rules](/userlock/docs/reference/access-policies/geolocation): enforce access policies based on user location.
- [Session limits](/userlock/docs/reference/access-policies/session-limit): allow or deny SaaS logins entirely for specific users.