22 SSO/SAML to hardened IdP

Caveats

• SSO moves the blast radius to the IdP — an IdP compromise is now a full Workspace compromise, so the IdP must itself be phishing-resistant (№7) or it’s a downgrade of authentication.
• By default Google’s 2SV settings do not apply to users signing in via a third-party IdP — MFA becomes the IdP’s job unless post-SSO verification is on, so verify MFA is actually enforced at the IdP, and keep Google-side 2SV on for every OU the SSO profile does not cover.
• Signing out of the IdP does not end the Google session — the two lifetimes are independent, and the session-length ceiling (№12) is where their interaction is configured.

Setup steps

1. 1. Add a third-party SSO profile (SAML or OIDC) with the IdP's sign-in/sign-out URLs and verification certificate.
   open ↗

   

   https://admin.google.com/ac/security/sso · captured 2026-07-15

   Security › Authentication › SSO with third-party IdP

   SSO profile = <IdP name>; IdP entity ID, Sign-in page URL, Sign-out page URL, Change password URL, Certificate uploaded (up to two)

2. 2. Assign the profile to the OUs (organizational units) / groups that must federate; leave the break-glass admin OU on 'None (Google)' so it can still sign in when the IdP is down or compromised.

   Security › Authentication › SSO with third-party IdP › Manage SSO profile assignments

   OU <staff>

   <IdP profile>

   OU <break-glass>

   None (Google authentication)

3. 3. Under the newer SSO profiles, super admins always authenticate directly with Google; the legacy SSO profile does not guarantee this (super-admin SSO can occur via IdP-initiated or domain-specific sign-in flows), so migrate off it if still in use. That bypass is the break-glass property this control leans on when the IdP is down or compromised — and it is why Google-side 2SV must stay enforced for the admin OU: the super-admin password never stops working.

   Security › Authentication › SSO with third-party IdP

   Super admins = Google sign-in (fixed behaviour of the newer SSO profiles; not guaranteed on the legacy profile); Google-side 2SV enforced for the admin OU

4. 4. Keep Google-side 2SV/phishing-resistant enforcement in place for any account not covered by the SSO profile, so partial-SSO accounts are not left password-only.
   open ↗

   

   https://admin.google.com/ac/security/2sv · captured 2026-07-15

   Security › Authentication › 2-Step Verification

   2SV enforcement

   On for all non-federated OUs

5. 5. Turn on post-SSO verification for the federated OUs, so Google still runs its own risk-based challenges — and 2SV where configured — after the IdP asserts a sign-in. It is the one Google-side check left standing between a compromised IdP session and the tenant.

   Security › Authentication › Login challenges

   Post-SSO verification

   On for every OU assigned a third-party SSO profile

Ongoing maintenance

• automatable: script Before IdP certificate expiry: rotate the certificate in the SSO profile (watch the expiry date with a scheduled check).

How to verify

1. Sign in as a federated test user — the login must redirect to the IdP. Then sign in as the break-glass account — it must NOT redirect and must accept Google credentials.