Google Cloud / G Suite Connector by Microsoft Password Sync

Sean Breen 1

I am migrating from using the on-premise google cloud sync and password applications to using the Azure Enterprise application Google Cloud / G Suite Connector by Microsoft to provision Azure AD accounts in our Google Workspace domain. I have also setup Single sign-on so users are redirected to the Microsoft authentication portal when logging into their Gmail account.

Google super admin accounts cannot use third-party SSO for authentication. My question is, will their Gmail password still sync with their Azure AD account? Provisioning runs every 40 minutes, will it also sync their Azure password to their Gmail account?

Sandeep G-MSFT 14,646 Reputation points Microsoft Employee

2022-11-02T10:10:59.77+00:00

@Sean Breen

As I understand you are setting up google cloud application in Azure and also you will be configuring user provisioning for this application.
Users accessing google cloud application will be redirecting to Azure AD for authentication.

In this scenario, if user is added to Azure AD as guest user. And if guest user is trying to access the application, they will be redirected to Azure AD authentication login page. Post entering the username, request gets redirected to user's home IDP for authentication. In your scenario it is google

Once google authenticates the user they will be redirected back to azure AD. Azure will give access to the application.

Now, in this scenario Azure doesn't hold any passwords of user. It is google who will be doing authentication as user's home IDP is google.

Let me know if I have misunderstood your ask, you can let me know and we can connect offline to work on this.
Sean Breen 1 Reputation point

2022-11-02T11:17:54.017+00:00

@Sandeep G-MSFT

The home IDP is in Azure AD. I'm using the Enterprise application in Azure called Google Cloud / G Suite Connector by Microsoft to provision users in Google Workspace. This runs every 40 minutes in Azure and will add/update users in Google. Using the same enterprise application, I setup SSO via SAML, and in the Google admin console, I setup Azure as an SSO third-party IDP.

Google Super Admin accounts, which are added/updated using the Azure provisioning setup, cannot use an SSO third-party IDP. This is done on purpose by Google. I would like to know when the provisioning task in the Azure Enterprise app runs (every 40 min), will it update the Google Super Admin's password in Google?

I have been trying to get a straight answer from Google support over the past few days. One of the support techs said the password would sync. However, I cannot fully trust that answer since the tech didn't fully understand the question.

I hope this clears up any confusion. Thank you.
Sean Breen 1 Reputation point

2022-11-04T13:39:48.49+00:00

Google support cannot answer the question, citing that they did not create the connector. At this point, switching the setup from testing to live might be the only way to get an answer.
87799714 1 Reputation point

2022-12-04T20:41:20.573+00:00

I am also in the similar situation, at present Google Cloud / G Suite Connector by Microsoft was set up as enterprise application to Synchronie Users from our Azure AD to Google Cloud. However, i noticed that when users wants to sign in on Google, their Azure password is not working.

The idea is to have a managed (single username and a password) in both platforms, when users are created from Azure AD with their password, the password should also sync to google during the provisionining. However, while checking the provisioning settings in the Azure AD, i noticed that user's password are not synchronized.

1 answer

Danny Zollner 9,521 Reputation points Microsoft Employee

2022-12-06T16:20:57.203+00:00

User passwords in Azure AD will not sync outbound to any other systems. Passwords in Azure AD are hashed/salted in a manner that is one-way, meaning the original value of the password can never be retrieved. As the original value cannot be retrieved, it cannot be sent to other systems.
Please sign in to rate this answer.

3 people found this answer helpful.

0 comments No comments
Sign in to comment