Skip to main content
Google Workspace integrates with Summand via SAML 2.0 through the WorkOS Admin Portal. (Direct Continue with Google OAuth is also available on the login screen for any Google user — that’s separate from org-managed SSO.)

​
Setup

1

Verify your domain in Summand

Settings → Organization → Domain Verification → Configure, then publish the DNS TXT record. Verified domains are routed to your Workspace SSO on sign-in.
2

Open the SSO Admin Portal

Settings → Organization → Single Sign-On → Configure. The portal opens scoped to your org.
3

Pick Google Workspace

Choose Google Workspace in the portal. WorkOS provides:
  • The ACS URL
  • The Entity ID
  • The required attributes: email, name, optionally given_name, family_name
4

Create the SAML app in Google Admin

From admin.google.com, go to Apps → Web and mobile apps → Add app → Add custom SAML app. Paste the ACS URL and Entity ID from the portal; set Name ID format to EMAIL and Name ID to Basic Information → Primary email.Detailed Google-side steps are in the WorkOS Google Workspace guide.
5

Configure attribute mapping in Google

Map these attributes:
6

Download Google's metadata

On the SAML app’s IdP details page, download the Metadata XML or copy the SSO URL, Entity ID, and certificate.
7

Return to the WorkOS portal

Upload the metadata XML (or paste the individual fields). WorkOS validates and pre-fills.
8

Enable the SAML app for users

Back in Google Admin, on the SAML app page, set the service status to On for everyone (or for a specific OU). New apps default to Off, which is the most common cause of “user gets blocked at Google” errors.
9

Test the connection

Click Test connection in the WorkOS portal. WorkOS runs an end-to-end Google sign-in flow and reports the result.

​
Group → role mapping

Google’s custom SAML apps don’t send group memberships in the SAML response by default. Summand doesn’t map IdP groups to organization roles itself. New users join as members, and admins change roles in Settings → Organization → Members. WorkOS can assign roles from IdP groups; contact support@intelligible.ai to set that up for your organization.

​
Why no Directory Sync?

Google Workspace does support SCIM, and WorkOS supports a Workspace SCIM connector. If you want it, Settings → Organization → Directory Sync → Configure and pick Google Workspace in the portal — note that this requires your Workspace admin to set up a service account and enable the Admin SDK API on the Google side. The WorkOS portal walks through that.

​
Removing the connection

Single Sign-On → Disable in the WorkOS portal. Existing sessions persist until they expire.