Add Google as an identity provider (preview)
Applies to: Workforce tenants
External tenants (learn more)
By setting up federation with Google, you allow customers to sign in to your applications with their own Google accounts. After you add Google as one of your user flow's sign-in options, customers can sign up and sign in to your application with a Google account. (Learn more about authentication methods and identity providers for customers.)
Tip
To try out this feature, go to the Woodgrove Groceries demo and start the “Sign-in with a social account” use case.
Prerequisites
Create a Google application
To enable sign-in for customers with a Google account, you need to create an application in Google Developers Console. For more information, see Setting up OAuth 2.0. If you don't already have a Google account, you can sign up at https://accounts.google.com/signup
.
Sign in to the Google Developers Console with your Google account credentials.
Accept the terms of service if you're prompted to do so.
In the upper-left corner of the page, select the project list, and then select New Project.
Enter a Project Name, select Create.
Make sure you're using the new project by selecting the project drop-down in the top-left of the screen. Select your project by name, then select Open.
Under the Quick access, or in the left menu, select APIs & services and then OAuth consent screen.
For the User Type, select External and then select Create.
On the OAuth consent screen, under App information
- Enter a Name for your application.
- Select a User support email address.
Under the Authorized domains section, select Add domain, and then add
ciamlogin.com
andmicrosoftonline.com
.In the Developer contact information section, enter comma separated emails for Google to notify you about any changes to your project.
Select Save and Continue.
From the left menu, select Credentials
Select Create credentials, and then OAuth client ID.
Under Application type, select Web application.
- Enter a suitable Name for your application, such as "Microsoft Entra External ID."
- In Valid OAuth redirect URIs, enter the following URIs. Replace
<tenant-ID>
with your customer Directory (tenant) ID and<tenant-subdomain>
with your customer Directory (tenant) subdomain. If you don't have your tenant name, learn how to read your tenant details.
https://login.microsoftonline.com
https://login.microsoftonline.com/te/<tenant-ID>/oauth2/authresp
https://login.microsoftonline.com/te/<tenant-subdomain>.onmicrosoft.com/oauth2/authresp
https://<tenant-ID>.ciamlogin.com/<tenant-ID>/federation/oidc/accounts.google.com
https://<tenant-ID>.ciamlogin.com/<tenant-subdomain>.onmicrosoft.com/federation/oidc/accounts.google.com
https://<tenant-subdomain>.ciamlogin.com/<tenant-ID>/federation/oauth2
https://<tenant-subdomain>.ciamlogin.com/<tenant-subdomain>.onmicrosoft.com/federation/oauth2
Select Create.
Record the values of Client ID and Client secret. You need both values to configure Google as an identity provider in your tenant.
Note
In some cases, your app might require verification by Google (for example, if you update the application logo). For more information, check out the Google's verification status guid.
Configure Google federation in Microsoft Entra External ID
After you create the Google application, in this step you set the Google client ID and client secret in Microsoft Entra ID. You can use the Microsoft Entra admin center or PowerShell to do so. To configure Google federation in the Microsoft Entra admin center, follow these steps:
Sign in to the Microsoft Entra admin center.
Browse to Identity > External Identities > All identity providers.
On the Built-in tab, next to Google, select Configure.
Enter a Name. For example, Google.
For the Client ID, enter the Client ID of the Google application that you created earlier.
For the Client secret, enter the Client Secret that you recorded.
Select Save.
To configure Google federation by using PowerShell, follow these steps:
Install the latest version of the Microsoft Graph PowerShell for Graph module.
Run the following command:
Connect-MgGraph
At the sign-in prompt, sign in with the managed Global Administrator account.
Run the following command:
Import-Module Microsoft.Graph.Identity.SignIns $params = @{ "@odata.type" = "microsoft.graph.socialIdentityProvider" displayName = "Login with Google" identityProviderType = "Google" clientId = "00001111-aaaa-2222-bbbb-3333cccc4444" clientSecret = "000000000000" } New-MgIdentityProvider -BodyParameter $params
Use the client ID and client secret from the app you created in Create a Google application step.
Add Google identity provider to a user flow
At this point, the Google identity provider has been set up in your Microsoft Entra ID, but it's not yet available in any of the sign-in pages. To add the Google identity provider to a user flow:
In your external tenant, browse to Identity > External Identities > User flows.
Select the user flow where you want to add the Google identity provider.
Under Settings, select Identity providers.
Under Other Identity Providers, select Google.
Select Save.
Next steps
Feedback
https://aka.ms/ContentUserFeedback.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see:Submit and view feedback for