A recent Google Workspace update transitioning from a Legacy Single Sign-On (SSO) profile to newer SSO profiles prevents Super Administrators from using Okta SSO because Security Assertion Markup Language (SAML) assertions are not redirected to Okta. Configure a dual-application setup using the Legacy SSO profile to restore access for Super Administrators while maintaining SSO for standard users. Super Administrators experience authentication failures when attempting to log into any Google Services using Okta SSO.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Integration Network (OIN)
• Google Workspace SAML Integration
• Single Sign-On (SSO)

A Google Workspace update transitioned from a Legacy SSO profile to newer SSO profiles. This update introduced a limitation where SSO is not supported for Super Administrators because the SAML assertions for Super Administrators are not redirected to Okta.

How is Okta Single Sign-On configured for Google Workspace Super Administrators?

Create a dedicated Okta application for Super Administrators with an empty RPID, configure a second application for standard users, and enable the Legacy SSO profile in Google Workspace.

1. Create Application 1 for Super Administrators as a new integration and leave the RPID field empty.

NOTE: Leaving the RPID field empty ensures authentication only occurs using the Identity Provider (IdP) initiated flow. This change breaks SSO functionality for every user currently managed by the Google Workspace SSO Profile associated with the removed RPID.

2. Connect Application 1 to the Legacy SSO Profile to ensure Super Administrators authenticate using the IdP-initiated flow.
3. Create Application 2 for all other users using an RPID value taken from a separate SSO profile within Google Workspace. This distinct profile applies to all users except Super Administrators.
4. Navigate to Security > Authentication > SSO with third-party IdP in Google Workspace.
5. Select the Legacy SSO profile option and select the Enable legacy SSO profile checkbox.
6. Assign the SSO profile to the organizational units or groups containing the Super Administrators.

• Verify that the domain-specific Service URLs setting is configured to redirect users to the third-party IdP automatically.
• Initiate the Super Administrator sign-in process through the Okta dashboard instead of navigating directly to accounts.google.com.

If a Super Administrator initially signs in to Google using a non Super Administrator account and then authenticates with Super Administrator credentials when redirected to Okta, Google accepts the Super Administrator identity assertion from the IdP.

NOTE: Even when using the legacy SSO profile, Super Administrators cannot sign in with SSO in the following scenarios:

• When signing in to an SSO-enabled domain directly via admin.google.com, the administrator receives a prompt to use Google Workspace credentials and is not redirected to Okta.
• When signing in to the Google Drive synchronization client, the administrator bypasses SSO regardless of the device or browser used.

Related References

• Google: Signing in with SSO