> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinq.me/llms.txt
> Use this file to discover all available pages before exploring further.

# SAML SSO with Google Workspace

> Create a custom SAML app in Google Workspace and exchange SAML details with Blinq.

<Info>
  SSO is available on **Enterprise** plans, with your domains enabled by the Blinq team. Read [How SAML SSO works](/identity/how-sso-works) first — it covers registering your domains, which has to happen before the SAML settings will open.
</Info>

Google Workspace has no Blinq app in its catalogue, so you create a custom SAML app. Blinq needs no attribute mappings.

<Info>
  **After email signatures instead?** That's a separate integration — see [Google Workspace email signature sync](/integrations/google-workspace). You can set up either one without the other.
</Info>

## Create the SAML app

<Steps>
  <Step title="Open web and mobile apps">
    Go to [admin.google.com](https://admin.google.com) and open **Apps → Web and mobile apps**.
  </Step>

  <Step title="Add a custom SAML app">
    Select **Add app → Add custom SAML app**, give it a name and description, then **Continue**.
  </Step>

  <Step title="Copy Google's details">
    On the Google identity provider details screen, take the **SSO URL**, **Entity ID** and **Certificate**. Keep this tab open.
  </Step>
</Steps>

## Send Google's details to Blinq

In the Blinq dashboard, go to **Settings → SAML**.

| Copy from Google | Paste into Blinq                |
| ---------------- | ------------------------------- |
| SSO URL          | **Single Sign-On URL**          |
| Entity ID        | **Identity Provider Entity ID** |
| Certificate      | **Certificate**                 |

Select **Save**.

## Send Blinq's details to Google

<Steps>
  <Step title="Copy Blinq's service provider details">
    From the same SAML settings, copy the **ACS URL** and the **Service provider entity ID**.
  </Step>

  <Step title="Paste them into Google">
    Back in Google, select **Continue**, then paste them into **ACS URL** and **Entity ID**.
  </Step>

  <Step title="Set the name ID format">
    Set **Name ID format** to **EMAIL**.
  </Step>

  <Step title="Skip attribute mapping">
    Blinq needs no attribute mappings. Select **Finish**.
  </Step>
</Steps>

## Turn the app on

Open the **User access** section of your new app and turn the service **ON for everyone**, or for the organisational units that should have Blinq. Save.

<Info>
  Google can take a few minutes to apply an access change before a test sign-in will work.
</Info>

## Test before you enforce

Use **Test SAML login** in the Google app, signing in with an address on the domain you registered with Blinq. If it fails, Google's [SAML error messages](https://support.google.com/a/answer/6301076) name the field to correct.

Once a test sign-in works, switch on **Enforce SSO for all users** at the bottom of the Blinq SAML settings and save.

<Warning>
  Don't sign out of Blinq until a test sign-in has succeeded in another window. If enforcement is on and the configuration is wrong, only Blinq support can switch it back off.
</Warning>

<hr />

### Need help?

For any questions or issues, [contact Blinq support](https://support.blinq.me/en/) or email [support@blinq.me](mailto:support@blinq.me).