Step-By-Step Guide: Entra ID SSO + Directory Sync for Google Workspace (with screenshots)

Migrating organizations from Workspace to Microsoft 365 is routine for Marathon, but this client was already all-in on M365 and still needed a lightweight Google tenant to work with vendors that rely on Drive, Docs, and shared calendars. To avoid running two identity stores, we kept Entra ID as the source of truth and configured Google to trust it for both SSO and automated user life-cycle.

This isn\’t a requirement we see every day, but our client was already having problems with users creating personal Google accounts for work purposes (especially since they were tied to the organization’s domain). While both Google and Microsoft offer documentation, it tends to be fragmented—especially around provisioning. So in this guide, we’ll walk through how we configured Entra SSO and user lifecycle sync end-to-end, starting with the SAML setup and finishing with provisioning.

---

Why does this matter?

This is a long, in-depth article. Let\’s get the executive summary out in the open before diving into the technical details.

Before this project, our client juggled two identity stores, manual account creation, and a checklist to disable users twice whenever someone left. Moving Google Workspace to Entra SSO plus Directory Sync solved problems for almost every department:

• HR & Identity-Governance streamlines off-boarding: One termination workflow now suspends the Google account within minutes, closing a long-standing audit gap.
• Security enforces consistent Conditional Access: Geo blocks and phishing-resistant MFA apply to Google sessions automatically, leaving break-glass access only for super-admins.
• Finance recovers dormant SaaS spend: Directory Sync removes unused Workspace licenses the moment a user is de-provisioned in Entra, shaving double-digit percentages off the annual Google renewal.
• Service Desk eliminates password-reset noise: Users change credentials via Entra’s self-service portal, ending the steady stream of “I forgot my Google password” tickets.
• IT Leadership defers head-count growth: Automated provisioning replaces manual clicks, letting the existing team support new SaaS requests without additional hires.

For a team that needed Google for partner collaboration but wanted to keep overhead low, wiring the two platforms together proved the cleanest path. No extra onboarding steps, no second factor database, and no surprise bills at license true-up time.

We tackle clean-ups like this every week. Book a free consultation if you want a fast sanity check on your SaaS footprint.

Are you leveraging the cloud, or just paying for it?

---

Contents

• Set up Entra ID as the SSO provider for Google Workspace
• Sync Entra users into Google Workspace – Automatic User Provisioning vs Directory Sync
• Wrap Up

---

Set Up Entra ID as the SSO provider for Google Workspace

Step 1. In Entra ID → Enterprise apps, choose + New application and search for Google Cloud / G Suite Connector by Microsoft.

Step 2. After the app spins up, open it and select Set up single sign-on.

Step 3. Pick SAML as the sign-on method.

Step 4. In Basic SAML Configuration click Edit.

Step 5. Fill the three URL fields like so for Google Workspace, where your domain is entered after the “/a/”.

Step 6. Some documentation still points to https://www.google.com/a/yourdomain.com/ServiceLogin?continue=https://mail.google.com as the Sign-on URL. That works if you\’re using Gmail for mail routing—but most M365 orgs have Gmail disabled. In that case, signing in via this URL drops users on a broken screen instead of the apps dashboard.

Step 7. So, if you’re not using Gmail, change your Sign on URL to https://www.google.com/a/<yourdomain>/ServiceLogin?continue=https://workspace.google.com/dashboard like below.

Step 8. Users signing in with that dashboard URL land on the Google apps panel, not an empty Gmail inbox.

Step 9. You can leave the Attributes & Claims section as-is, no changes needed. Next, head to the SAML Certificates section and download the Base64 certificate:

Step 10. Still on the overview page, copy the Login URL, and the Microsoft Entra Identifier. Keep these handy; you’ll paste them into Google. For the logout URL, use https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0

Step 11. Optional: if you want to test with a pilot user, you can add a single test account (e.g. “googlessotest”) to Users & Groups for the new enterprise app before rolling to everyone.

Step 12. In Google Admin, go to Security → Authentication → SSO with third-party IdP.

Step 13. Click Add SAML profile.

Step 14. Name the profile, then paste the Login URL and IdP Entity ID from Entra per the previous step.

Step 15. Change password URL: https://mysignins.microsoft.com/security-info/password/change

Sign out page URL: https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0

Upload the Base64 certificate you downloaded earlier from the Enterprise App setup in Entra.

Step 16. Copy the Entity ID and ACS URL shown in Google, then paste both back into the Basic SAML Configuration in Entra.

Step 17. Google should now list the profile status as Complete in Third-party SSO profiles.

---

Sync Entra users into Google Workspace

We’re ready to test, but first we have to move-or auto-provision-accounts from Entra to Google. Two paths exist: Automatic User Provisioning via the connector, or Directory Sync via Google’s tool. Directory Sync is the safer default because it cleans up and disables accounts when they’re removed from Entra. Automatic Provisioning still has valid use-cases (e.g., when you must keep Google accounts alive after Entra deletion), so we’ll document both.

Option 1: Enable Automatic User Provisioning

(not recommended for most orgs, but useful where Google accounts must stay active after Entra removal)

Step 1. Using our pilot user we created earlier (googlessotest), open Google Admin → Security → Access and data control → API control.

Step 2. Click Settings in the API control panel.

Step 3. Ensure Trust internal, domain-owned apps is checked.

Step 4. Return to the Entra enterprise app and open Provisioning.

Step 5. Set Provisioning mode to Automatic. If the portal prompts you to switch to portal.azure.com, follow the link and retry.

Step 6. Click Authorize, then sign in with a Google admin that has Admin API privileges (we used a dedicated service account).

Step 7. Grant the requested permissions when the consent prompt appears.

Step 8. After consent, the connection test should show Success and the mode remains Automatic.

Step 9. Default attribute mappings work for most tenants, but you can tweak them as seen here in this Microsoft Learn Article – Tutorial: Configure G Suite for automatic user provisioning with Microsoft Entra ID – Microsoft Entra ID | Microsoft Learn

Then choose Edit Provisioning to enable the job.

Step 10. Set Provisioning status to On and click Save.

Step 11. The initial cycle starts immediately. If a user lacks givenName or surname, mapping will fail-add a fallback (e.g., “_”). You can also trigger Provision on demand for spot checks.

Step 12. If Provision on demand isn’t visible, open the … menu to reveal it.

Step 13. In Google Admin → Users, confirm the pilot account now exists.

Step 14. In Security → SSO with third-party IDPs, assign the new SAML profile to the same pilot group. Super-admin accounts stay excluded by design, to prevent lock-out.

Step 15. After validation and testing, expand the Entra assignment and Google SSO scope to the production group or top-level OU.

---

Configure Directory Sync (Recommended Option)

Directory Sync is a Google-built connector that mirrors Entra users one-to-one—including disables—so it’s cleaner than the automatic engine Microsoft documents.

Because it handles the full user life-cycle, Directory Sync is our recommended path for most tenants. Google’s official setup guide starts with the screen below.

We’ll walk through the same flow in screenshots.

Step 1. In Google Admin → Directory → Directory Sync, open the landing page.

Step 2. Click Add Azure Active Directory.

Step 3. Review prerequisites, then click Continue.

Step 4. Provide a connection Name, choose Authorize & Save, and sign in with an Entra Global Admin (or Cloud App Admin) to grant consent.

Step 5. Click Accept on the permission prompt.

Step 6. Entra now shows a new enterprise application called Google Directory Sync.

Step 7. Return to Directory Sync, select the external directory, and click Set up user sync.

Step 8. Choose one or more Entra groups (use a pilot group first), click Verify, then Continue.

Step 9. Pick the target OU for the synced users.

Step 10. Review attribute mappings—first name, last name, and primary email are required—then Continue. Any existing users in Google Workspace will not be duplicated as long as the UPN in Entra matches the Primary Email in Google Workspace.

Step 11. Choose a de-provision action (we keep Suspend to match Entra “blocked”). Click Continue.

Step 12. Run Simulated sync to preview adds and changes.

Step 13. If the simulation looks good, select Activate & Start Sync (or come back later via Sync status).

Step 14. When the first run completes, the targeted users appear in Google Workspace with status Active.

Step 15. Confirm the Google Cloud / G Suite Connector in Entra is assigned to the same group used for Directory Sync.

Step 16. In the original enterprise app, set Provisioning status to Disabled to avoid duplicate accounts.

Step 17. Finally, expand the Google SAML profile to the parent OU or broader group so every synced user authenticates via Entra.

---

Wrap Up

When a user opens Drive, Docs, or another Workspace URL, they’re automatically redirected to the Microsoft sign-in page for SAML authentication.

Entra Sign-in logs now show events under Google Cloud / G Suite Connector, complete with Conditional Access details.

After go-live, your end users will only ever see one familiar Microsoft sign-in screen—no more “forgot my Google password” calls or confusion over which account to use. Behind the scenes, all authentication requests for Drive, Docs, and other Workspace apps flow through Entra’s Conditional Access engine, so you get consistent risk signals, geo-blocking and phishing-resistant MFA across both M365 and Google sessions. This unified experience not only reduces help-desk noise but also raises your baseline security posture by treating every app the same.

Operationally, it pays to bake in a simple audit cadence: every quarter, spot-check that your Directory Sync jobs are completing cleanly, review any SAML sign-in failures, and confirm that your pilot and production groups still align in both Entra and Google. And don’t forget your break-glass planning—keep at least one super-admin outside of SSO scope so you can always log in directly if Entra is ever unavailable. With these checks in place, you’ll have a single identity plane that’s both easy to manage and robust enough to support new collaboration scenarios as they arise.