Manage single sign-on (SSO) with Microsoft accounts

Team administrators can choose whether users can sign in to Google Workspace Essentials with their corporate credentials, using single sign-on (SSO) with Microsoft OpenID Connect (OIDC).

Before you begin

If you want to allow people to sign in with SSO:

Check if your organization's IT administrator has set up the following prerequisites for OIDC in your organization’s Microsoft Entra ID tenant:

• The Entra ID tenant needs to be domain verified.
• Users must have Microsoft 365 licenses.
• The username (primary email) of the Google Workspace admin enabling SSO must match the primary email address of your Entra ID tenant admin account.

If you want to stop allowing people to sign in with SSO:

Once you turn off SSO, team members will need to choose a password the next time they sign in to Google Workspace.

Turn SSO on or off

1. Open Drive and click Team dashboard in the lower left corner.
2. On the left, click Permissions.
3. Under Single sign-on (SSO), select an option:
   • None—People on your team sign in with their Google Account.
   • Microsoft (OIDC)—People on your team sign in with their Microsoft 365 account.
4. In the confirmation box, click Confirm.
5. If you selected Microsoft (OIDC), enter your Microsoft password.

   You'll also need to accept the OAuth consent and grant access to Microsoft Identity.

If you can't sign in to Workspace with your Microsoft account

If SSO is turned on and team members can't sign in to Google Workspace with their Microsoft account, it's likely the connection to your organization's identity provider (IdP) isn't working. In this case, as a team administrator, you can sign in using a verification code sent to your work email address. Then you can turn off SSO so team members can also sign in to Google Workspace.

If you're a team administrator for Essentials Starter:

1. Go to accounts.google.com/recovery
2. Enter your work email address.
3. Choose Get a verification code at your email.
4. Enter the verification code you received by email.
5. After you sign in, go to your Team dashboard and turn off SSO.