G Suite single sign-on

G Suite single sign-on (SSO) lets all members of your workspace sign in to Slack using their G Suite accounts. This can be set up in two ways: with G Suite Auth using OAuth 2.0 or G Suite SAML using SAML 2.0.  


Google Auth vs. Google SAML

Read the table below to see what each SSO setup supports.

  Google Auth Google SAML
Profile Syncing*
Just-in-Time Provisioning
Authentication with multiple email domains**
Pre-provisioning  
Custom SCIM profile fields  
Automatic user deactivation  
Rule-based access in your identity provider  
Enterprise Grid compatible    ✓


Google Auth only syncs email address and display name. Google SAML syncs email addresses, display names, and first and last names.
** Additional domains need to be manually added when using Google Auth. This process is automatic with Google SAML.


Set up G Suite Auth

Standard and Plus plans 

Enterprise Grid plan

Workspace Owners and Admins can access and configure G Suite Auth SSO settings. Here's how:

  1. From your desktop, click your workspace name in the top left.
  2. Select Administration, then Workspace settings from the menu.
  3. Under the Authentication tab, click Configure for Google Apps authentication.
  4. Choose your authentication Settings. Visit Guide to single sign-on settings for more.
  5. Click Save Configuration.
  6. You will be asked to authenticate with your G Suite account.

G Suite Auth isn't available on the Enterprise grid plan.

Tip: To whitelist additional domains (so members can easily create accounts), send us a note. We’d be happy to help add (or remove) them.


Set up G Suite SAML

Plus plan

Enterprise Grid plan

Step 1: Configure an identity provider

  1. Workspace Owners and Admins need to configure an identity provider by enabling the Slack SAML app with a Google Admin account.
  2. Members will need to have accounts already set up in your workspace to sign in with their Google accounts.

Step 2: Set up SSO for your workspace

  1. From your desktop, click your workspace name in the top left.
  2. Select Administration, then Workspace settings from the menu.
  3. Next to SAML authentication, click Configure

Step 1: Configure an identity provider

  1. Org Owners and Admins need to configure an identity provider by enabling the Slack SAML app with a Google Admin account.
  2. Members will need to have accounts already set up in your Enterprise Grid org to sign in with their Google accounts.

Note: When asked for ACS URL, enter your Enterprise Grid org's URL (e.g., https://domain.enterprise.slack.com/sso/saml).


Step 2: Set up SSO for your organization

  1. From your desktop, click your workspace name in the top left.
  2. Select Administration, then Organization settings from the menu.
  3. Click Security in the left-side column.
  4. In the SSO Configuration section, click Configure SSO. 


After G Suite SSO is enabled

Members can continue to go to your workspace’s URL to sign in after G Suite is enabled. Here’s what they can expect:

  • New members 
    New members can create an account on your workspace as long as they use a whitelisted email address. To get started, they can click Create account.
  • Existing members 
    Existing members will receive an SSO binding email to authenticate their accounts. Once binding is complete, they can sign in to your workspace using their G Suite credentials.

💡 To learn more, visit Connect your SSO account with Slack. 


Manage G Suite single sign-on

Switch G Suite domains  

Whether your email domain is changing or you're switching from one instance of G Suite to another, you can easily update your G Suite domain.

Standard and Plus plans 

Enterprise Grid plan

  1. From your desktop, click your workspace name in the top left.
  2. Select Administration, then Workspace settings from the menu.
  3. Click the Authentication tab.
  4. Select Change Settings. You may be asked to sign in with your Google account.
  5. Select Switch Domains.
  6. You’ll be redirected to Google’s sign-in page where you can sign in with your new Google domain.
  7. All members of your workspace will be sent a binding email to authenticate their accounts.

Org Owners and Admins can change their G Suite domain through their identity provider using a Google Admin account.

Trouble switching domains? You may have multiple domains whitelisted. Drop us a line and we'll remove the ones you no longer need.


Change email addresses

Workspace Owners/Admins and Org Owners/Admins can edit and manage member's email addresses.

Standard and Plus plans 

Enterprise Grid plan

  1. From your desktop, click your workspace name in the top left.
  2. Select Administration, then Workspace settings from the menu.
  3. Click Authentication.
  4. Beside Google Authentication Settings, click Change Settings.
  5. To the right of Settings, click Expand.
  6. Turn on Allow user to change their email address.
  7. Click Save Configuration.

You can now update email addresses from the Members page.

  1. From your desktop, click your workspace name in the top left.
  2. Select Administration, then Organization settings from the menu.
  3. In the left-side column click Security, then SSO Preferences.
  4. Turn on Allow user to change their email address.
  5. Click Save Changes.

You can now update email addresses from the Members page.

Tip: To make bulk changes to email addresses, please reach out to us. We'd be happy to help!


Provisioning and deprovisioning

Google Admins using SAML-based SSO can control member provisioning from the Slack SAML app. This can be found under Apps in their Google Admin console.

  • Provisioning
    Slack supports Just-in-Time Provisioning. This lets members create new accounts the first time they sign in to Slack using G Suite authentication.
  • Deprovisioning
    If someone leaves and you’d like to restrict their access, a Workspace Owner or Admin must deactivate their account from the Members page.
Who can use this feature?
  • Only Workspace Owners/Admins and Org Owners/Admins can use this feature.
  • Available on all paid plans.

Related Articles

Recently Viewed Articles