> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qumo-deploy.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace

> Set up your organization's OIDC connection with Google Workspace.

# Google Workspace

This page covers the Google side. Saving, testing and activating the connection are in
[Single Sign-On (OIDC)](https://docs.qumo-deploy.com/guides/sso/overview.md).

## Create the OAuth client

1. In the Google Cloud console, choose or create a project in your Workspace organization.
2. Under **Google Auth Platform** (**APIs & Services → OAuth consent screen** in older
   consoles), configure the app with the audience (user type) **Internal**, so that only
   users in your Workspace organization can sign in.
3. Under **Clients** (**Credentials**), select **Create client** (**Create credentials →
   OAuth client ID**) and choose the application type **Web application**.
4. Under **Authorized redirect URIs**, add the connection's redirect URI:
   `https://<console host>/oauth/sso/callback`. Create.
5. Copy the **Client ID** and **Client secret**.

> [!WARNING]
>
> Google's ID tokens carry neither `amr` nor `acr`, so an [MFA
> policy](https://docs.qumo-deploy.com/guides/sso/enforcement.md#mfa-policy) refuses every Google Workspace sign-in it applies
> to. Keep the MFA policy at `none` and enforce 2-Step Verification in the Google Admin console
> instead.

## Issuer

```
https://accounts.google.com
```

## Scopes and claims

The default scopes, `openid email profile`, are enough. Google sends `email`,
`email_verified` and `name` in the ID token, so the default claim mapping works as is. It
also sends `hd`, the user's Workspace domain.

Google does not send groups in ID tokens, so a Google Workspace connection carries no
groups.

## Example

```json theme={null}
{
  "issuer": "https://accounts.google.com",
  "client_id": "123456789012-abc123def456ghi789jkl012mno345pq.apps.googleusercontent.com",
  "client_secret": "<client secret>"
}
```

Then run a test login and activate the connection; see
[Single Sign-On (OIDC)](https://docs.qumo-deploy.com/guides/sso/overview.md#3-run-a-test-login).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.