A Google Workspace Single Sign-On (SSO) error occurs when the Google Workspace legacy profile remains active or the user holds the Super Admin role. Resolve this by configuring the third-party SSO profile, disabling the legacy profile, or downgrading the user role. The following error message appears during authentication even when the administrator configures the correct domain in the General tab, and the Application username format matches the Google Workspace format:

Couldn't sign you in Contact your domain for help.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Google Workspace
• Single Sign-On (SSO)

The error occurs for the following reasons, even when the Relying Party Identifier (RPID) and domain match the correct values:

• The Legacy Profile in Google Workspace remains active.
• The user holds the Super Admin role.

What steps resolve the Google Workspace SSO error?

If the RPID remains unset, follow the Google Workspace Security Assertion Markup Language (SAML) setup instructions found on the Sign-On tab for the Root organization SSO profile (RPID unset).

Configure the third-party SSO profile for the organization and disable the legacy profile in Google Workspace.

1. Set the Manage SSO profile assignments to the Organizations third-party SSO profile.
2. Disable Legacy Profile in Google Workspace if no Google organizational unit requires it.

Downgrading the Super Admin role resolves the error.

If the URL contains rrk=21, verify if the user holds a Super Admin role. This error typically occurs because Google Workspace restricts Super Admins from signing in through this specific flow. If the user does not require administrative access, downgrade the user to a standard role or use a non-admin account.

Related References

• How to Configure SAML 2.0 for Google Workspace
• Assign your top organizational unit and update service URLs
• Super administrator SSO