--- title: "Single Sign-On with Google Workspace (SAML)" slug: "single-sign-on-with-google-workspace-saml" updated: 2025-08-20T18:58:05Z published: 2025-08-20T18:58:05Z canonical: "support.kandji.io/single-sign-on-with-google-workspace-saml" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt > Use this file to discover all available pages before exploring further. # Single Sign-On with Google Workspace (SAML) ### Create a SAML Connection 1. In Kandji, navigate to the **Settings** page. 2. Click the **Access** tab. 3. Find the **Authentication** section and click the **Add** button on the bottom left. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0804AM@2x(1).png) 4. In the new pane, click **Custom SAML**. 5. Click **Next**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0806AM@2x.png) 6. Click **Show Advanced Details**. 7. Copy the Assertion Consumer Services URL into a text document for later use. 8. Copy the Entity ID into a text document for later use.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Sd5v7SbpdblIUulWmTdTbDs4IeZbe9zDUg.png) 9. Leaving this tab open, continue to the Google Workspace Admin console following the instructions below. ### Add the Kandji application to Google Workspace 1. In a new browser tab, log in to [admin.google.com](https://admin.google.com) with a Google Workspace admin account. 2. Click the menu symbol at the top left. 3. Select **Apps**. 4. Select **Web and mobile apps**. 5. Click the **Add App** dropdown. 6. Select **Add custom SAML app**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/ETyOa9XdlZuCzh49ToVbrv32yS6HzOU9FQ.png) 7. On the App details page: 1. Set an **App name.** 2. Optionally, add a **Description**. 3. Upload an optional **App icon.** 4. Click **Continue.** ![X9G04ttqJJ_cG98DYmInwhW8hmiSKJQ3kQ](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/bo784q1fjzzp0kjolna4ywl3ehxtf404ag.png) 8. On the Google Identity Provider Details page, use **Option 2: Copy the SSO URL, entity ID, and certificate.** 1. Copy the **SSO URL** and save it to a text document for later use. 2. Download the **Certificate** and save it. 3. Click **Continue.** ![x6YHMb95gSoPUUkusqPg0UTACJcazPxojg](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/z8rvrp6rouxzr9ewp51yjkujbjr43q0vgw.png) 9. On the Service Provider Details page: 1. In the ACS URL field**,** paste the **Kandji Assertion Consumer Service URL** you copied earlier. 2. Paste the Kandji Entity ID you copied earlier in the **Entity ID** field. 3. Make sure that the **Signed response** option is checked. 4. Set the Name ID Format to **UNSPECIFIED**. 5. For NameID, make sure that **Basic Information > Primary email** is selected. 6. Click **CONTINUE.** ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Screenshot 2025-08-18 at 2.11.09 PM.png) 10. On the Attribute Mapping page: 1. Click on **Add Mapping** twice so that you can add the following two mappings: 1. Find the **First name** attribute in the dropdown menu and paste the following string: ```bash schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname ``` 2. Find the **Last name** attribute in the dropdown menu and paste the following string: ```bash schemas.xmlsoap.org/ws/2005/05/identity/claims/surname ``` 2. Click **Finish.**![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/6QS-kjnC978PyXg9uC4CI_obdNDs_YbOfA.png) 11. On the resulting app page, check under User Access to ensure that the service is turned on and that either a user group or organizational unit is selected. The Required Claim Attributes section of the [SAML-based Single Sign-on](/v1/docs/saml-based-single-sign-on) knowledge base article provides more about Kandji attribute mappings. 1. If it displays **OFF for everyone**, click on the disclosure triangle in the user access panel to assign a user group or organizational unit to the app. ![3KTbSGbrVnzJ4lytfa2Cd3uiBzdp_UW3Tw](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/rmxks8u4qigkwc8egjwifq6w1y2jjktf1g.png) 2. Optionally, please select a group or organizational unit to enable the service (by default, it will display all organizational units). 3. Set service status to **ON for everyone.** 4. Click **Save.![7OjG8vUOBNtxps7rS-7t0_saQcGdWeEySg](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/icpkktqkt3-ckdueifffl3t979v3wmmskg.png)** ### Configure the SAML Connection in Kandji 1. Go back to the Custom SAML modal in Kandji. 2. Give the connection a **Name**. 3. Paste in the **Sign-in URL** you copied from Google Workspace. 4. Upload the certificate you downloaded from Google Workspace.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/xj-vnyldzi3zfplmnayeqne1nbypco4rmg.png) 5. Ensure that the **User ID Attribute** is set to the default value of ```bash http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier ``` 6. Ensure that **Sign Request** is set to **Yes**. 7. Ensure that **Request Algorithm** is set to **RSA-SHA256**. 8. Ensure that **Sign Request Algorithm Digest** is set to **SHA 256**. 9. Set the **Protocol Binding** to **HTTP-POST**. 10. Click **Save** and then click **Cancel** to exit the configuration.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/bjq72-4r5fhu_6zbph5qm2be6gwgbmwccw.png) ### Enable the SAML Connection Once you have configured the SAML connection in Kandji and your identity provider, you can enable it. For step-by-step instructions, please refer to the **Enable and Manage a Connection** section of our Single Sign-on support article. ### Enforce Single Sign-on Once you have configured at least one Single Sign-on connection, you can disable the standard authentication connection. Disabling Kandji standard authentication will disable the ability for Kandji administrators in your tenant to authenticate via email/password, Google Sign-in, or Office 365 Sign-in. Please refer to our [](https://support.kandji.io/sso)[Single Sign-on support article](/v1/docs/single-sign-on) for step-by-step instructions. ### Add a User to Kandji 1. Add a user to the **Admin Team** in Kandji by clicking **New User**. 2. Fill in all of the corresponding user information. This user must exist in Google Workspace and must be assigned to the Kandji SSO app in your Google Workspace tenant. 3. Click **Submit**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/kyRfUO8R2QbwIWGR00Z_WO4HZQy3Lqfihg(1).png) 4. Once the invite is submitted, close the Invite User window. 5. Refresh the Access page in Kandji. You should see the user you just added. 6. Check the user’s email to accept the invitation and log into Kandji with the new SAML SSO connection.