Google Workspace SAML SSO and Directory Sync for SaaS Apps

Google Workspace can serve as an identity provider for B2B SaaS products through custom SAML applications, requiring vendors to provide an HTTPS ACS URL and entity ID while obtaining Google’s metadata, SSO URL, and signing certificate in return. Because Google normally signs only the SAML assertion and uses a user’s mutable primary email as the default NameID, service providers should validate the consumed assertion carefully, verify issuer and audience, use stable directory IDs where possible, and securely handle RelayState and tenant-domain checks. Administrators can map user attributes and up to 75 groups, enable access by organizational unit or group, and should expect configuration changes to take as long as 24 hours. For directory synchronization and offboarding, vendors may use Google’s automated SCIM provisioning when it is available for the customer’s app, but should confirm this in the Admin console because support for custom apps is inconsistent; otherwise, they can periodically pull users through the read-only Admin SDK Directory API and use notifications as supplementary signals. The guidance also emphasizes keeping JIT provisioning as a fallback, deactivating users removed from the directory, revoking their access fully, and planning for Google’s five-year SAML certificate expiry by supporting certificate overlap and advance rotation reminders.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.