> For the complete documentation index, see [llms.txt](https://docs.peig.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.peig.io/welcome-to-peig-documentation/deployment-guides/google-workspace.md).

# Google Workspace

This guide covers the full process of integrating Peig with Google Workspace — from creating a Google Cloud Project through to managing user accounts. Once complete, Peig acts as the SAML identity provider for your Google Workspace domain, and all authentication is device-bound.

### Prerequisites

Before starting, confirm you have the following in place:

* A **corporate domain** already configured in your Google Workspace tenant (referred to throughout as `[DOMAIN]`)
* A **Google Workspace Super Administrator** account with access to the Admin Console at [admin.google.com](https://admin.google.com/)
* A working **Peig instance** with access to the Configuration Console
* Access to **Google Cloud Console** at [console.cloud.google.com](https://console.cloud.google.com/)
* The **Workspace server name / IdP Info** from your Peig installation

### How the deployment works

The Google Workspace deployment follows a **continuous onboarding model** — unlike Microsoft 365, there is no fixed migration window or cutover event. Users are onboarded progressively and begin using device-bound authentication as they are added to the Peig group.

**Phase 1: Google Cloud Setup** — Create a Cloud Project, configure the OAuth consent screen, and generate OAuth credentials. No impact on existing authentication.

**Phase 2: API & SSO Configuration** — Enable the Admin SDK API and configure a third-party SSO profile pointing to Peig as the identity provider.

**Phase 3: SAML & Group Setup** — Create the custom SAML app and a dedicated Google Group. Only users in this group are affected by the SSO configuration.

**Phase 4: Peig Configuration** — Add Google Workspace as a provider in the Peig Configuration Console and complete all four configuration sections.

**Phase 5: Account Management** — Use the Google identifiers dashboard to create, link, and sync user accounts between Google Workspace and Peig.

{% hint style="danger" %}
Never add the Super Administrator account to the Peig group or any SSO-enforced group. The Super Admin is your break-glass fallback — Google excludes it from third-party SSO flows by design. See Step 3 — SAML App & Group Setup for details.
{% endhint %}

### Deployment steps

| Step                           | Description                                                             | Phase                          |
| ------------------------------ | ----------------------------------------------------------------------- | ------------------------------ |
| 1. Google Cloud Project        | Create the Cloud Project that houses all API integrations               | Google Cloud Setup             |
| 2. OAuth Consent & Credentials | Configure the OAuth consent screen and generate Client ID and Secret    | Google Cloud Setup             |
| 3. SAML App & Group Setup      | Enable the Admin SDK, configure SSO, create the SAML app and Peig group | API & SSO / SAML & Group Setup |
| 4. Configure Peig Connector    | Add Google Workspace as a provider in the Peig Configuration Console    | Peig Configuration             |
| 5. Managing Google Identifiers | Create, link, and sync accounts via the Google identifiers dashboard    | Account Management             |

### Additional guides

* Rollback and Recovery — Revert to standard Google authentication without deleting any configuration