Trouble setting up Google Workspace SAML as an IdP for authentication

Question

We currently use Google workspace and all SSO authentication. We need to configure SAML with Google instead of the Built-in Google auth so we can pass groups for RBAC.

I did setup a custom SAML provider under External Identities - Custom. This created fine, but I have something setup wrong. I am a bit unsure of what my ACS and Entity ID on the google side should be. I have found conflicting documentation and none of them seem to work. Here are a few of the attempts we have made:

ACS URL: https://login.microsoftonline.com/<tenantID>/saml2 Entity ID: https://sts.windows.net/<tenantID>/

ACS URL: https://<tenantID>.ciamlogin.com/login.srf Entity ID: https://login.microsoftonline.com/<tenant ID>/

ACS URL: https://login.microsoftonline.com/login.srf Entity ID: https://login.microsoftonline.com/<tenant ID>/

Are any of these close?

I may have something wrong on the Microsoft side too, but unsure until I know I have the google IdP side correct.

In Azure -> Microsoft Entra ID -> External Identities -> All Identity providers -> Custom I have setup Name: Google Identity Provider protocol: SAML Issuer URI: https://accounts.google.com/o/saml2?idpid=<IdP ID> Passive authentication endpoint: https://accounts.google.com/o/saml2/idp?idpid=<IdP ID> Certificate: <our IdP certificate>

Answer 1

Hi @Jason Williams,

Thank you so much for the detailed explanation of your setup — I truly appreciate the clarity you've provided. You're definitely on the right track with configuring Google Workspace as a SAML Identity Provider for Microsoft Entra to support group-based RBAC.

---

1. ACS URL and Entity ID

Based on your scenario, if you're using a standard Microsoft Entra ID tenant, the correct values are:

• ACS URL: https://login.microsoftonline.com/<tenant-id>/saml2
• Entity ID: https://sts.windows.net/<tenant-id>/

These are the most commonly used values for standard Entra tenants. The other combinations you’ve tried are typically used in Microsoft Entra External ID (CIAM) scenarios, which involve different endpoints and policies.

---

2. Additional Considerations

For detailed guidance, please refer to Microsoft’s official documentation: Add a SAML/WS-Fed identity provider - Microsoft Entra External ID

It’s important to verify whether the SAML2 endpoint can consume SAMLP responses from Google. Compatibility issues here could cause the login to fail.

A common issue is not updating the SAML metadata on either the Google or Microsoft side. Please ensure both ends have the latest metadata and configuration.

---

3. Next Steps

To assist you further, could you please provide:

• The exact error message or behavior you're seeing during the login attempt?
• Whether the issue occurs on the Google side or the Microsoft Entra side?

This will help us pinpoint the root cause more effectively.

---

4. If the Issue Persists

If the issue continues after verifying the metadata and configuration, I recommend raising a support ticket with Microsoft so we can investigate the backend logs and SAML processing in more detail.

---

Please let me know if this helps or if you have any further questions — I’m here to support you every step of the way!

If this response has been helpful, I’d be incredibly grateful if you could mark it as the accepted answer and give it a thumbs up. Your feedback means a lot and helps us continue delivering great support experiences.

Warm regards,

Bob

Answer 2

Hello @Jason Williams

To correctly configure SAML SSO from Google Workspace to Microsoft Entra ID, use the following settings in Google:

1. ACS URL: https://login.microsoftonline.com/<tenantID>/saml2
2. Entity ID: https://sts.windows.net/<tenantID>/

Replace <tenantID> with your actual Microsoft Entra (Azure AD) tenant ID.

On the Microsoft side, navigate to Entra ID > External Identities > All Identity Providers > Custom, and configure the following:

1. Issuer URI: https://accounts.google.com/o/saml2?idpid=<IdP ID>
2. Passive Authentication Endpoint: https://accounts.google.com/o/saml2/idp?idpid=<IdP ID>

Be sure to replace <IdP ID> with your Google IdP ID.

Upload the certificate from Google and ensure user attributes—such as email—are mapped correctly.

This setup enables Google to act as the Identity Provider (IdP), passing user information and group membership to Entra ID for role-based access control (RBAC).

If you encounter any issues, please let me know—we can connect offline to troubleshoot further.