Skip to content
Bifröst OrbitDocs

Guides

Connect Google SSO

Let your people sign in with their Google Workspace accounts, and choose what they get when they join.

How-to guide2 min read

Before you start

Google SSO is for organisations on Google Workspace. Bifröst Orbit has one Google sign-in for every organisation, so there is no app to register in Google and no secret to keep. You only tell Orbit which Workspace domains are yours.

Personal Google accounts, such as Gmail, are always refused, even for people you have added. They can use an email code if you allow it.

If Google SSO cannot be switched on and says it is not set up on this server, Google sign-in is not available yet. Ask the Bifröst Orbit team.

1Switch on Google SSO

On the Sign-in tab, under Ways to sign in, switch on Google SSO. The Google SSO section appears below.

2Add your Workspace domains

Under Workspace domains, enter the domains your people's Google Workspace accounts use, such as example.com. Separate several with commas.

Choose Save changes. Each domain can belong to only one organisation.

3Choose who gets in

Under Who gets in:

  • Only people you add lets anyone with a Workspace account on your domains sign in, but they see no satellites until an owner or admin adds them. People you have already added keep what you gave them.
  • Everyone on these domains lets everyone with a Workspace account on your domains join, with the role and satellites under Everyone gets. Nobody needs adding by hand.

Google sends no roles or groups, so there is no role mapping. Give someone a higher role or more satellites under Members; what you set there is kept.

What Orbit checks

Orbit lets a Google account in only when:

  • Google says the email address is verified,
  • the account belongs to a Google Workspace organisation, and its domain is one you listed,
  • the email address is on that same domain.

Everything else, such as a suspended account, works as for every other way to sign in.

What happens next

  • People choose Sign in with Google on your sign-in address, or enter their work email on the main sign-in page and go straight to Google, then pick their work account.
  • To make sure nobody uses an email code instead, add your domain under Require SSO for your domains and choose Google SSO. See Choose how your people sign in.
  • If Google says access is blocked, your Google Workspace admin can allow Bifröst Orbit in the Google Admin console, under Security, API controls, App access control.
  • Switching Google SSO off keeps your domains and choices, but lets nobody in with Google until it is on again.

Was this page helpful?

Read next

Choose how your people sign inAllow email codes or SSO, and require SSO for your company's email domains.Connect Microsoft SSORegister your own app in Microsoft Entra, connect it to your organisation, and give access from Microsoft app roles.Add and manage membersAdd people to your organisation, choose their role and satellites, and remove them.