Description:
This control ensures that Single Sign-On (SSO) is enforced for all users within the Google Workspace organization. SSO requires users to authenticate through a centralized Identity Provider (IdP) before accessing Google Workspace services, providing consistent authentication and access control across the organization.


Rationale:
Enforcing SSO centralizes authentication management, improves user experience, and strengthens security by allowing organizations to apply consistent authentication policies, including Multi-Factor Authentication (MFA), conditional access controls, and account lifecycle management.


Impact:

  • Centralizes user authentication through a trusted Identity Provider.

  • Reduces reliance on separate application credentials.

  • Improves user access management and security oversight.

  • Supports compliance requirements related to identity and access management.

  • May require integration and maintenance of an external Identity Provider.


Default Value:
Disabled by default. Administrators must explicitly configure and enforce Single Sign-On for Google Workspace users.


Remediation

Test Plan

  1. Sign in to the Google Admin console with administrative privileges.

  2. Navigate to Security → Authentication → SSO with third-party IdP.

  3. Verify that Single Sign-On is enabled for the applicable organizational units.

  4. Select a user account that is subject to the SSO policy.

  5. Attempt to access Google Workspace services using the user account.

  6. Verify that the user is redirected to the configured Identity Provider for authentication.

  7. Verify that direct Google Workspace authentication is not permitted where SSO enforcement is required.

  8. If SSO is not enforced for all required users, follow the Implementation Plan to remediate the issue and repeat the test.


Implementation Steps:

  1. Sign in to the Google Admin console with Super Administrator privileges.

  2. Navigate to Security → Authentication → SSO with third-party IdP.

  3. Enable Set up SSO with a third-party identity provider.

  4. Enter the required Identity Provider details, including:

    • Sign-in page URL.

    • Sign-out page URL (if applicable).

    • Verification certificate.

  5. Apply the SSO configuration to the applicable organizational units.

  6. Save the configuration changes.

  7. Test authentication using a non-administrative user account.

  8. Verify that users are redirected to the configured Identity Provider during sign-in.

  9. Verify that SSO enforcement is applied to all required organization members.


Backout Plan:

  1. Sign in to the Google Admin console with Super Administrator privileges.

  2. Navigate to Security → Authentication → SSO with third-party IdP.

  3. Disable Set up SSO with a third-party identity provider.

  4. Save the configuration changes.

  5. Verify that users can authenticate directly through Google Workspace.

  6. Verify that authentication behavior reflects the updated configuration.


References: