Skip to main content

Allowing sign-in from Google Workspace

This page is for the person who administers your company's Google Workspace. It explains what happens when your staff use Sign in with Google on this platform, and the one setting that may need changing on the Google side.

If your company uses personal Google accounts rather than Google Workspace, nothing on this page applies; Google sign-in works as soon as your Workspace Admin on the platform allows it.

What the platform asks Google for​

When someone clicks Sign in with Google, Google asks them to share three things with the platform:

  • their name,
  • their profile picture,
  • their email address.

That is all. The platform never asks for access to mail, calendar, Drive, contacts, or your directory, and it never writes anything to Google. Google uses the standard OpenID Connect sign-in for this, so there is no data connector and no ongoing access to your Google data.

On the Google consent screen the application is named ioX-Pulse, the platform your portal runs on, and the request comes from the platform's own registered application, not from your provider's domain. Google shows this screen the first time each person signs in; afterwards it only shows the account picker.

Who decides who can sign in​

Access is controlled on the platform, not in Google:

  • A person can only sign in if a Workspace Admin has invited them on the platform. Google sign-in never creates an account.
  • The Workspace Admin can restrict Google sign-in to specific email domains (for example, only example.com addresses).

Google's per-app user assignment, which you may know from SAML apps, does not apply here: Google sign-in is an OAuth application, and Google either allows it for your organization or blocks it. Assigning it to users or groups is done through invitations on the platform.

When your Google admin needs to act​

Most organizations need no Google-side change. If your Google Workspace is set to block third-party apps that have not been reviewed by an admin, staff see a Google message such as "This app is blocked" or "Access blocked: your organization's policy" when they try to sign in. In that case, mark the platform as allowed:

  1. Sign in to the Google Admin console at admin.google.com.

  2. Go to Security → Access and data control → API controls.

  3. Under App access control, click Manage Third-Party App Access.

  4. Click Configure new app and choose OAuth App Name or Client ID.

  5. Search for the platform's client ID:

    975458889197-fhrg4574ts181od782sg2qpiph6ifdvv.apps.googleusercontent.com

  6. Select the app, choose the organizational units it applies to, and set the access to Limited or Trusted. Limited is enough: the platform only uses basic sign-in data, which Google classes as unrestricted. Click Configure.

The change takes effect within a few minutes. Google's own reference for this screen is Control which third-party and internal apps access Google Workspace data.

Removing someone's access​

Disabling or deleting a person's Google account stops them signing in with Google; Google refuses them before they ever reach the platform. It does not remove their membership on the platform, and their platform password keeps working. Ask the Workspace Admin to suspend or remove them on the platform as well.

If you reassign an email address to a new person, the platform will refuse the new person's Google sign-in with "not a member of this workspace" until the Workspace Admin disconnects Google on the old member and invites the new one. See Allowing Google sign-in for your workspace.

Troubleshooting​

  • "This app is blocked" from Google: the app has not been allowed in your Workspace. Follow the steps above.
  • "This Google account is not a member of this workspace" from the platform: the person has not been invited, or picked a different Google account than the one they were invited with. The picker appears every time, so a personal account chosen by mistake is the usual cause.
  • "Google sign-in is limited to specific email domains": the Workspace Admin has an allowed-domain list on the platform that does not include this person's email domain. Alias domains must be listed too.
  • Two-factor prompts twice: Google's own two-step verification and the platform's two-factor security are separate. If staff are asked for a code by both, the Workspace Admin can turn off the platform-side requirement for the workspace.