Google Apps and Azure SSO

[Simcfc73]

Hi,

 

Just a quickie, we currentyl use GAPS to sync windows credentials to Google but I fancy moving to Azure logon.

 

We have MFA setup for both and M$ has the nice bypass MFA for local domain in Azure so Outlook signs straight in, if I use Azure for Google would that bypass MFA too or would it argue with the Google 2FA thats enabled?

 

Its a half term job which I am looing at tackiling.

 

Thanks

[chaplic]

I've never hooked google up to Azure AD, but just about everything else, and the login behaviour is the same as office365, i.e. if you have conditional access and/or trusted networks then then experience is the same for any enterprise apps.

[free780]

I believe its just setting up gsuite for saml to AzureAD.

[peej2k]

Microsoft have a tutorial here:

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/google-apps-tutorial

[Simcfc73]

Yeah I've got that, its the SSO part of Google I was wondering about.

[peej2k]

Yeah I've got that, its the SSO part of Google I was wondering about.

 

G Suite > Security > Setup Single Sign-On (SSO)

 

Tick "Setup SSO with third party identity provider"

Provide Sign In, Sign Out and Change Password URLs

Upload your verification certificate

Save your changes

 

And that's all you really need to do on the Google end. You'll still need to use GCDS to import your users into Google however, as it needs a user account at the G Suite end to verify against.

[Simcfc73]

Can this be turned on and off for different groups? I'm using groups to assign licenses and MFA to staff in Azure.

[peej2k]

No. It's all or nothing. The moment you enter a qualifying email address and submit it, it'll send you to the SSO pages for login. The only users that won't apply to are super admins.

[Simcfc73]

I've redone it a couple of times but its not working, it fills in the username but not the password.

 

I just need the google drive for staff too so will need make a new tile.