Connect to Google Workspace through Access
This guide covers how to configure Cloudflare Access as a single sign-on provider for your Google Workspace account.
1. Create an application in Zero Trust
Select SaaS application.
Fill in the following information:
- Application: Google.
- Entity ID:
- Assertion Consumer Service URL:
<your_domain.com>is your Google Workspace domain.
- Name ID Format: Email.
On the next page, you will see your SSO endpoint, Access Entity ID or Issuer, and Public key. These values will be used to configure Google Workspace.
2. Create a certificate from your public key
Copy and then paste your Public key into a text editor.
Wrap the certificate in
-----END CERTIFICATE-----. For example,-----BEGIN CERTIFICATE-----<PUBLIC_KEY>-----END CERTIFICATE-----
Set the file extension as
3. Create an SSO provider in Google Workspace
- Log in to your .
- Go to Security > Authentication > SSO with third party IdP.
- Select Third-party SSO profile for your organization.
- Enable Set up SSO with third-party identity provider.
- Fill in the following information:
- Sign-in page URL: Copy and then paste your SSO endpoint from Zero Trust.
- Sign-out page URL:
<team-name>is your Zero Trust team name.
- Verification certificate: Upload the certificate file containing your public key.
- (Optional) Enable Use a domain specific issuer. If you select this option, Google will send an issuer specific to your Google Workspace domain (
google.com/a/<your_domain.com>instead of the standard
4. Test the integration
- In your , go to Apps > Google Workspace > Gmail > Setup,
- Copy your Gmail Web address.
- Open an incognito browser window and go to your Gmail web address (for example,
An Access login screen should appear.
Error: “G Suite - This account cannot be accessed because the login credentials could not be verified.”
If you see this error, it is likely that the public key and private key do not match. Confirm that your certificate file includes the correct public key.