SSO from Azure AD to G Suite

How to integrate G Suite with Azure Active Directory (Azure AD) is explained. By integrating Azure AD with G Suite, users in Azure AD can login without Authentication to G Suite. G Suite is included in Azure Gallery SaaS apps so that the integration configuration is described in "Microsoft Tutorial document".

By use of FIDO2 Password-less Login with ThinC-AUTH, users can login to Azure AD from either Windows 10 or Browsers. Office365 portal is also entered without additional login. In access panel of Office365, users just click icon of G Suit to enter into G Suit platform without further authentication. The figure below shows the flow of SSO, which requires login authentication once. Since FIDO2 login has highest security among others so that secure SSO algorithm such as SAML is requested to maintain the security level.

How to setup SSO Configuration

The followings are steps for both Azure AD and G Suite to set up SAML SSO setting to work SSO from Azure AD to G Suite.

1. Azure AD SSO Configuration

2. G Suite SSO Configuration

3. Azure AD User ProvisioningAzure AD > Enterprise applications > G Suite > Manage > User and Groups > Add user

4. G Suite User Provisioninｇ Google Admin console > organization unit > Add new user

(1) Azure AD SSO Configuration

1. Go to Azure AD > Enterprise Application > New Application and select G Suite from Gallery apps. and load G Suite site.
2. Go to Azure AD > Enterprise Application > G Suite > Single Sign On, select "SAML" and fullfill the below.

(2) G Suite SSO Configuration

1. Go to G Suite Admiin console > Security
2. Select > Set up single sign on

G Suite Admin Console > Security > Set up Single Sign On

reference

1. "Tutorial: Azure Active Directory single sign-on (SSO) integration with G Suite", 2019/09/23, https://docs.microsoft.com/ja-jp/azure/active-directory/saas-apps/google-apps-tutorial