# Connect Google SSO

> Let your people sign in with their Google Workspace accounts, and choose what they get when they join.

Source: https://docs.bifrostorbit.com/orbit/admins/connect-google-sso/

## Before you start

Google SSO is for organisations on Google Workspace. Bifröst Orbit has one Google sign-in for every organisation, so there is no app to register in Google and no secret to keep. You only tell Orbit which Workspace domains are yours.

Personal Google accounts, such as Gmail, are always refused, even for people you have added. They can use an email code if you allow it.

If **Google SSO** cannot be switched on and says it is not set up on this server, Google sign-in is not available yet. Ask the Bifröst Orbit team.

## 1. Switch on Google SSO

On the **Sign-in** tab, under **Ways to sign in**, switch on **Google SSO**. The **Google SSO** section appears below.

## 2. Add your Workspace domains

Under **Workspace domains**, enter the domains your people's Google Workspace accounts use, such as `example.com`. Separate several with commas.

Choose **Save changes**. Each domain can belong to only one organisation.

## 3. Choose who gets in

Under **Who gets in**:

- **Only people you add** lets anyone with a Workspace account on your domains sign in, but they see no satellites until an owner or admin adds them. People you have already added keep what you gave them.
- **Everyone on these domains** lets everyone with a Workspace account on your domains join, with the role and satellites under **Everyone gets**. Nobody needs adding by hand.

Google sends no roles or groups, so there is no role mapping. Give someone a higher role or more satellites under **Members**; what you set there is kept.

## What Orbit checks

Orbit lets a Google account in only when:

- Google says the email address is verified,
- the account belongs to a Google Workspace organisation, and its domain is one you listed,
- the email address is on that same domain.

Everything else, such as a suspended account, works as for every other way to sign in.

## What happens next

- People choose **Sign in with Google** on your sign-in address, or enter their work email on the main sign-in page and go straight to Google, then pick their work account.
- To make sure nobody uses an email code instead, add your domain under **Require SSO for your domains** and choose **Google SSO**. See [Choose how your people sign in](https://docs.bifrostorbit.com/orbit/admins/set-up-sign-in/).
- If Google says access is blocked, your Google Workspace admin can allow Bifröst Orbit in the Google Admin console, under **Security**, **API controls**, **App access control**.
- Switching Google SSO off keeps your domains and choices, but lets nobody in with Google until it is on again.