--- title: "Single Sign-On with Google Workspace (Native)" slug: "single-sign-on-with-google-workspace-native" updated: 2025-06-17T13:43:29Z published: 2025-06-17T13:46:52Z canonical: "support.kandji.io/single-sign-on-with-google-workspace-native" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt > Use this file to discover all available pages before exploring further. # Single Sign-On with Google Workspace (Native) > [!WARNING] > If you're [requiring authentication with Automated Device Enrollment](/v1/docs/configuring-require-authentication-for-enrollment) for iOS enrollments and using Google Workspace as your identity provider, the Single Sign-On entry must be created [using Custom SAML](/v1/docs/single-sign-on-with-google-workspace-saml). The built-in Google Workspace integration is not supported. ### Create a Google Workspace Application 1. **Log in** to the Google Developer [API Console.](https://console.developers.google.com/) Then click **CREATE PROJECT**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/rnrll3jf6j9v-5fpxb0kmiimtzezsjnzdw.png) 2. Enter a **Project name**. 3. Select your **Organization**. 4. Select your **Location**. 5. Click **Create**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/4ilaxe0gvxquc90b48cizizq8ng4ukfanq.png) 6. In the sidebar, click **Credentials**. 7. On the right side of the window, near the top, click Create Credentials. If this is your first time creating a client ID, you may also be prompted to [configure your consent screen](https://support.google.com/googleapi/answer/6158849#zippy=%2Cuser-consent). ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/ndfzlbmqcpduxf3whobzc28lkrkjfkhj5g.png) 8. From the menu that appears, choose **OAuth Client ID**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/2cgyyqz1bdxp6bt45y0hd_5-rzsnqczveg.png) 9. For "**Application Type**," click the menu and select "**Web application"**. 10. In the **Name** field, enter a **Name** for your OAuth client. 11. In the **Authorized JavaScript Origins** section, in the **URIs** field, enter the following:For US tenants: ```bash https://auth.kandji.io ``` For EU tenants: ```bash https://auth.eu.kandji.io ``` 12. In the **Authorized redirect URIs** section, in the **URIs** field, enter the following:For US tenants: ```bash https://auth.kandji.io/login/callback ``` For EU tenants: ```bash https://auth.eu.kandji.io/login/callback ``` 13. Click **Create.** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/wuf6jozoxiru0chzlqjmmtxortqod4gomw.png) 14. Copy the text from the **Client ID** field and save it for later use. 15. Copy the text from the **Client Secret** field and save it for later use. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/legyspjmiwa3c0fuq2qs9swjcphcleb9mq.png) ### Create a Google Workspace Connection 1. In Kandji, in the sidebar, click **Settings.** 2. Click the **Access** tab. 3. Find the **Authentication** section and click the **Add** button at the bottom left of the authentication section. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0804AM@2x(1).png) 4. In the new blade, click **Google Workspace**. 5. Click **Next**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0828AM@2x.png) 6. Customize or use the default **Name** for the Google Workspace connection (this will be shown on the login page). 7. Enter the **Google Workspace Domain** that the application is registered within. > [!WARNING] > If migrating to a new Google Workspace domain using the same connection, this value can be changed to match your new domain. Best practice, however, would be to [create a new SSO connection using SAML](/v1/docs/single-sign-on-with-google-workspace-saml). 8. Enter the **Client ID** you previously copied from Google Workspace. 9. Enter the **Client Secret** you previously copied from Google Workspace. 10. Click **Save.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/joxsemfxkrgnglfcu7uogiutemyivax2ga.png)** 11. After saving, a new dialogue box will appear with a link to **authorize your connection.** A Google Workspace administrator for your domain must click the link and complete this process to authorize the application. This box will not go away after authorization is completed. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/qgk1lnpexpbu_7lsq9hsd2c7sm4migxfga.png) 12. In the new window that launches, sign in and click **Accept**. 13. After clicking **Accept,** you will be brought to an authorization success page. 14. Your connection has now been successfully configured and may be enabled and tested. ### Enable the SAML Connection Once you have configured the SAML connection in Kandji and your identity provider, you can enable it. For step-by-step instructions, please refer to our Single Sign-On support article. ### Enforce Single Sign-On Once you have configured at least one Single Sign-On connection, you can disable the Standard Authentication connection. Disabling Kandji standard authentication will disable the ability for Kandji administrators in your tenant to log in via Email/Password, Google Sign-in, or Office 365 Sign-in. Please refer to our [Single Sign-On support article](/v1/docs/single-sign-on) for step-by-step instructions.