15 SSO/SAML to hardened IdP

Caveats

• SSO moves the blast radius to the IdP¹
• Google’s 2SV settings do not apply to users signing in via a third-party IdP²
• Signing out of the IdP does not end the Google session³
• Never assign the SSO profile to the break-glass account (№20)⁴

Setup steps

1. open ↗

   

   https://admin.google.com/ac/security/sso · captured 2026-07-15

   Security › Authentication › SSO with third-party IdP ↗

   Add a third-party SSO profile (SAML or OIDC) with the IdP's sign-in/sign-out URLs and verification certificate.

   SSO profile = <IdP name>; IdP entity ID, Sign-in page URL, Sign-out page URL, Change password URL, Certificate uploaded (up to two)

   Setting up SSO ↗

2. Security › Authentication › SSO with third-party IdP › Manage SSO profile assignments

   Assign the profile to the OUs (organizational units) / groups that must federate; leave the break-glass admin OU on 'None (Google)' so it can still sign in when the IdP is down or compromised.

   OU <staff>

   <IdP profile>

   OU <break-glass>

   None (Google authentication)

   Setting up SSO ↗

3. Security › Authentication › SSO with third-party IdP ↗

   Under the newer SSO profiles, super admins always authenticate directly with Google; the legacy SSO profile does not guarantee this (super-admin SSO can occur via IdP-initiated or domain-specific sign-in flows), so migrate off it if still in use. That bypass is the break-glass property this control leans on when the IdP is down or compromised — and it is why Google-side 2SV must stay enforced for the admin OU: the super-admin password never stops working.

   Super admins = Google sign-in (fixed behaviour of the newer SSO profiles; not guaranteed on the legacy profile); Google-side 2SV enforced for the admin OU

   Super administrator SSO ↗

4. open ↗

   

   https://admin.google.com/ac/security/2sv · captured 2026-07-15

   Security › Authentication › 2-Step Verification ↗

   Keep Google-side 2SV/phishing-resistant enforcement in place for any account not covered by the SSO profile, so partial-SSO accounts are not left password-only.

   2SV enforcement

   On for all non-federated OUs

   Deploy 2-Step Verification ↗ How 2-Step Verification works with third-party IdPs ↗

Ongoing maintenance

• automatable: script Before IdP certificate expiry: rotate the certificate in the SSO profile (watch the expiry date with a scheduled check).

How to verify

1. Sign in as a federated test user — the login must redirect to the IdP. Then sign in as the break-glass account — it must NOT redirect and must accept Google credentials.