Google Apps & Azure AD SSO

[DavidYoung]

Hello,

 

We have just moved all our users over to Office 365 which is working out well, but we also want to be able to give users Google logins for things like Classroom.

 

I have GADS working and all our users are provisioned but I can't seem to get GAPS working to get the passwords sync'd, plus the limitation of having to change passwords to sync is a big pain.

 

I tried a few months ago to get SSO working between Azure AD and Gapps using this tutorial: https://msdn.microsoft.com/en-us/library/azure/dn308591.aspx and it worked great, but it seemed to be completely random who got assigned to the application and who didn't, and obviously the ones who didn't weren't able to access it.

 

I know that group application assignment is part of AAD premium, but surely we must be able to a bulk assign to all users or something, with 3000 odd users in our tenancy it is not feasible to manually assign them. Has anyone got this working?

 

Thanks

David

[garethEds]

Wow - I've just been looking a this and just posted on Edugeek. I guess I should have searched first.

 

I'm going to have to put 800 kids into a Pupil Group and then hopefully allocate the group to allow access.

 

Gareth

[DavidYoung]

Hi Gareth,

 

The problem with using groups to give access is that it is an Azure AD premium feature that you have to license. I couldn't find a better way for free. Are you paying for AAD Premium?

 

David

[pete]

^ You could try poking @EduTech - he's blogged about it a bit:

 

Windows Azure Active Directory & Application Integration Single Sign-On | James Evans - EduTech's Blog

[garethEds]

Hi Gareth,

 

The problem with using groups to give access is that it is an Azure AD premium feature that you have to license. I couldn't find a better way for free. Are you paying for AAD Premium?

 

David

 

No - not paying for AADPremium. I'll do each user individually I suppose :-(

 

Gareth

[careykf]

Hi,

 

Has anyone had further success with this?

 

I am relatively new to the Azure AD Premium game - Do I need to buy azure ad premium for ALL users or could I just add it to one of my admin users who can then manage the groups?

Has anyone found a mechanism through the Azure AD PowerShell module to enable users for google apps on a more automatic mechanism?

 

Thanks

[jaykelly]

We have azure ad syncing with a local AD, azure then is managing all accounts and Google Apps is setup in 3rd party SSO mode. Pro tip: you only need 1x azure AD Premium to access the premium features. So this is what we have:

 

LOCAL AD

Accounts created, accounts put into groups, one main group (staff) has everyone in it

AZURE AD SYNC TOOL

Then all accounts/groups are synced with tool on our server upto azure AD

GOOGLE APPS

Google apps is then setup using the application under azure and the tutorial they provide, users are provisioned automatically by auto appling provisioning to anyone in group STAFF (which is everyone).

LOG ON PAGE

When a user tries to use google apps OR chromebooks it takes them to our azure ad login portal. Staff on windows 10 who are setup with azure ad join have SSO from their computer login.

 

It all works as it should, only thing i have issues with is no groups move into google apps which makes it hard inside of google admin for some tasks.

 

Thats a bit of a mess of describing it above...

[bb12489]

I'm glad I've come across this topic. I'm also researching the use of Azure AD SSO for Google Apps. Currently we have few existing users in Google Apps that have been synchronized using GADS. We use very few Google services at the moment since our main focus is now Office 365. My question is, can I enable Azure AD SSO to Google Apps, even though I have existing users in Google Apps? Will I have to delete the exiting users and re-sync them from Azure AD? Or can I just roll with SSO from Azure AD and continue to use GADS for account syncing? Any help would be greatly appreciated!

[replicant101]

We're planning on rolling this out next week. thanks for those steps jaykelly

[jaykelly]

Oo im not sure about GADS sorry, i know you can create stand alone google apps account even when SSO is enabled just fine.

[michellem812]

I'm starting this now too...I got the Azure Basic and got the users to all provision but don't want to manually assign all 13,000 students. So you're saying that you bought 1 license of Azure AD Premium ($72/year), assigned it to yourself as the administrator, and then you were able to auto-assign entire groups - is that correct? $72/year isn't bad, if that's all it takes, but I'm still unclear on who gets the license assigned.

[jaykelly]

do they currently live in local AD? you dont need premium to sync them with Azure AD. Once they are in azure AD they automatically get pushed into google apps. We cant auto provision Office 365 licenses unfortunately without a different system

[michellem812]

We aren't using local AD, we are using Office365 accounts that are automatically in Azure. I followed these steps (https://technofocusin.wordpress.com/2015/12/03/how-to-integrate-google-apps-with-azure-active-directory/) and all my Azure AD users are provisioned, but it appears that the last steps on that page mean that I have select the users and assign Google Apps to them...but the web page will only do about 20 at a time. So I'm trying to figure out how to assign all 13,000 students at once. Azure Basic doesn't let me assign to groups, only users.

[chrisjako]

Did anyone figure this out without going premium? maybe through powershell for azure?