Connect to Google Workspace through Access
This tutorial covers how to configure Cloudflare Access as a single sign-on provider for your Google Workspace account.
Time to complete: 15 minutes
1. Create an application in Zero Trust
Log in to Zero Trust and navigate to Access > Applications.
Select SaaS application.
Fill in the following information:
- Application: Google.
- Entity ID:
- Assertion Consumer Service URL:
<your_domain.com>is your Google Workspace domain.
- Name ID Format: Email.
On the next page, create an Access policy for your application. For example, you could allow users with an
On the next page, you will see your SSO endpoint, Access Entity ID or Issuer, and Public key. These values will be used to configure Google Workspace.
2. Create a certificate from your public key
Copy and then paste your Public key into a text editor.
Wrap the certificate in
-----END CERTIFICATE-----. For example,-----BEGIN CERTIFICATE-----<PUBLIC_KEY>-----END CERTIFICATE-----
Set the file extension as
3. Create an SSO provider in Google Workspace
- Log in to your Google Admin console.
- Navigate to Security > Authentication > SSO with third party IdP.
- Select Third-party SSO profile for your organization.
- Enable Set up SSO with third-party identity provider.
- Fill in the following information:
- Sign-in page URL: Copy and then paste your SSO endpoint from Zero Trust.
- Sign-out page URL:
<team-name>is your Zero Trust team name.
- Verification certificate: Upload the certificate file containing your public key.
- (Optional) Enable Use a domain specific issuer. If you select this option, Google will send an issuer specific to your Google Workspace domain (
google.com/a/<your_domain.com>instead of the standard
4. Test the integration
To test the integration, open an incognito browser window and go to
https://mail.google.com/. An Access login screen should appear.
Error: “G Suite - This account cannot be accessed because the login credentials could not be verified.”
If you see this error, it is likely that the public key and private key do not match. Confirm that your certificate file includes the correct public key.