## Enable Google for SSO

URL: https://docs.atlan.com/product/integrations/identity-management/sso/how-tos/enable-google-for-sso

> Configure SAML 2.0 single sign-on between Google Workspace and Atlan so your users sign in to Atlan with their Google credentials. Exchange service provider and identity provider metadata, assign users in Google Admin Center, and optionally sync Google groups to Atlan.

Configure SAML 2.0 single sign-on so your users sign in to Atlan with their existing Google Workspace credentials. Setup moves metadata in both directions: you copy Atlan's service provider details into a new SAML app in Google Admin Center, collect Google's identity provider metadata during that process, then import it back into Atlan.

Start in Atlan, build and configure the app in Google Admin Center, then return to Atlan to finish. Group sync is optional and covered at the end.

## Prerequisites

Before you begin, make sure you have:

- **Admin access in Atlan.** Only admins can configure SSO.
- **Super Administrator access in Google Workspace** so you can create a SAML app and manage user access in Google Admin Center.
- A decision on the **default role** new users receive on first sign-in (Admin, Member, or Guest). Set it in [Set default role for SSO users](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt). Most workspaces use Member.

## Get Atlan's service provider details

Before setting up the app in Google Admin Center, get the two values Atlan provides.

1. In your Atlan workspace, click **Settings** from the left menu.

 If you are using the **Old UI (Classic)**, from the left menu, click **Admin**.

2. Click **SSO**.

3. Click **New**, then select **Google** as the provider.

4. Under _Service provider metadata_, copy both values: you'll paste them into Google Admin Center later:

 - **ACS URL**
 - **Entity ID**

Keep this tab open. You'll return here to finish setup.

## Configure in Google Admin Center

All the app setup happens in the Google Admin Console: create the app, collect the IdP metadata, configure SAML settings, and assign users.

### Create SAML app

In [Google Admin Center](https://admin.google.com):

1. In the left menu, click **Apps**, then click **Web and mobile apps**.

2. Click **Add app**, then click **Add custom SAML app**.

3. Enter a name for the app (for example, `Atlan`), then click **Continue**.

### Download identity provider metadata

After clicking Continue, Google shows the **Google Identity Provider details** page. Download the metadata file here, before moving on:

1. Click **Download metadata** to save the `GoogleIDPMetadata.xml` file to your computer.

2. Click **Continue**.

Keep the file somewhere accessible: you'll upload it to Atlan in a later step.

### Configure SAML settings

With the metadata saved, continue through the rest of the app setup:

1. Under _Service provider details_, enter the values you copied from Atlan:

 - **ACS URL**: paste Atlan's _ACS URL_.
 - **Entity ID**: paste Atlan's _Entity ID_.

2. Click **Continue**.

3. Under _Attribute mapping_, add the following mappings from Google Directory attributes to app attributes:

 - Primary email → `email`
 - First name → `firstName`
 - Last name → `lastName`

4. (For group sync) Under _Group membership (optional)_, configure the following so Google sends each user's group memberships to Atlan:

 - **Search for a group**: add each Google group you want to sync. You can add up to 75 groups.
 - **App attribute**: enter `memberOf`.

 This is required only if you plan to [sync Google groups to Atlan groups](#sync-google-groups-to-atlan-groups).

5. Click **Finish**.

### Assign users

Access to the SAML app is controlled by Google org units. From the app's page in Google Admin Center:

1. Expand **User access**.

2. Under _Service status_, select **ON for everyone**, or select specific org units to restrict access.

3. Click **Save**.

Only users whose service status is ON can sign in to Atlan through Google SSO.

:::info Restrict who gets auto-provisioned
Selecting specific org units here is how you control who gets auto-provisioned in Atlan. Any Google user whose service status is OFF for this app is rejected at sign-in: no Atlan account is created for them.
:::

## Connect Google to Atlan

With the app configured in Google Admin Center, go back to Atlan to finish. Open your Atlan SSO settings (the **Google** provider you started earlier) and:

1. Under _Identity provider metadata_, click **Import from XML**.

2. Select the `GoogleIDPMetadata.xml` file you downloaded from Google.

3. Click **Save**.

Your users can now sign in to Atlan with Google. By default, they can still sign in with a local Atlan account too: to require Google, enable **Enforce SSO** (see below).

## Enforce SSO (optional)

Once Google SSO works, you can disable local email-and-password sign-in so everyone authenticates through Google:

1. In Atlan, go to **Settings → SSO** and open your Google provider.

2. Enable **Enforce SSO**.

After enforcing SSO, have your Google administrator manage access from Google Admin Center rather than [inviting users directly in Atlan](https://docs.atlan.com/llms/governance/access-control/invite-new-users/llms.txt). Users with access are provisioned automatically on their first sign-in.

## Sync Google groups to Atlan groups (optional) {#sync-google-groups-to-atlan-groups}

Map Google groups to Atlan groups so users land in the right teams automatically on every sign-in.

Before you start:
- Configure the group membership section with the `memberOf` app attribute in Google Admin Center when you create the SAML app. Group sync won't work without it.
- [Create the Atlan groups](https://docs.atlan.com/llms/governance/access-control/manage-groups/llms.txt) you want to map to first: you can only map to groups that already exist.

To set up the mapping in Atlan:

1. In Atlan, go to **Settings → SSO** and open your Google provider.

2. Switch to the **Groups Mapping** tab.

3. For each Atlan group, under the _SSO Groups_ column, type the name of the matching Google group (for example, `Data Engineering`), then click **Save** on that row.

Group membership syncs every time a user signs in. If you rename a group in Google, update the mapping in Atlan to match.

:::note
Google Admin Center supports a maximum of 75 groups in the group membership section of a SAML app. If your organization has more than 75 groups, prioritize the groups that need access control in Atlan.
:::

Once you've configured group mapping, you can add the mapped groups to a [persona](https://docs.atlan.com/llms/governance/access-control/create-a-persona/llms.txt) or [purpose](https://docs.atlan.com/llms/governance/access-control/create-a-purpose/llms.txt) to auto-assign permissions as users sign in.

For sync issues, see [Troubleshooting SSO](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt).

## Need help?

If users can't sign in or aren't landing in the right groups, see [Troubleshooting SSO](https://docs.atlan.com/llms/governance/access-control/troubleshooting-sso/llms.txt). Contact [**Atlan Support**](https://docs.atlan.com/support/submit-request) if the issue persists.

## Next steps

Now that users can sign in through Google, finish setting up access:

- [Set default role for SSO users](https://docs.atlan.com/llms/governance/access-control/set-default-user-roles-for-sso/llms.txt): Choose whether new users land as Member, Guest, or Admin.
- [Restrict auto user creation](https://docs.atlan.com/llms/governance/access-control/limit-sso-automatically-creating-users-when-they-log-in/llms.txt): Limit sign-in to only the users your identity provider assigns.
- [Configure SCIM provisioning](https://docs.atlan.com/product/integrations/identity-management/scim/how-tos/configure-scim-provisioning): Automate the full user lifecycle (optional).

---