Skip to content
Tallyfy

Integrate Google Workspace

Administrators only

Google Workspace SAML/SSO integration

Section titled “Google Workspace SAML/SSO integration”

Connect Google Workspace (formerly G Suite) with Tallyfy using SAML-based Single Sign-On. Your users authenticate with their Google credentials - no separate Tallyfy passwords needed.

Requirements

Section titled “Requirements”
  • Google Workspace admin account with super-administrator privileges
  • A Tallyfy administrator account on any paid plan
  • The Tallyfy SP values from the SSO wizard (shown when you pick Google Workspace)

Phase 1 - Create a custom SAML app in Google Workspace

Section titled “Phase 1 - Create a custom SAML app in Google Workspace”

Step 1: Create a custom SAML application

Section titled “Step 1: Create a custom SAML application”

  1. Sign in to the Google Workspace Admin console ↗

  2. Go to Apps > Web and mobile apps

  3. Click Add App > Add custom SAML app

    Google Admin Add custom SAML app menu for SSO setup

Step 2: Configure basic app settings

Section titled “Step 2: Configure basic app settings”
  1. Enter “Tallyfy” as the application name
  2. Optionally upload the Tallyfy logo
  3. Click Continue

Step 3: Collect Google identity provider details

Section titled “Step 3: Collect Google identity provider details”

  1. On the Google Identity Provider details page, copy the SSO URL (Single Sign-On URL).

  2. Copy the Entity ID (Issuer).

  3. Download the Certificate file.

    Google Admin Identity Provider details with SSO URL and certificate

Step 4: Configure service provider details

Section titled “Step 4: Configure service provider details”

Get the Tallyfy SP values from the wizard first: in Tallyfy, go to Settings > Organization > Security > SSO, start a new connection, pick Google Workspace, and copy the SP ACS URL and SP Entity ID it shows. Then, back in Google:

  1. Enter the Tallyfy ACS URL (Assertion Consumer Service URL) from the wizard.

  2. Enter the Tallyfy Entity ID (Service Provider Entity ID) from the wizard.

  3. Leave the Start URL field empty.

    Google Admin SAML service provider details with Tallyfy ACS URL

Step 5: Configure attribute mapping

Section titled “Step 5: Configure attribute mapping”

Map these user attributes exactly as shown:

Google Directory AttributeApp Attribute
Primary Emailemail
First NameFirstName
Last NameLastName

Click Finish. That’s it for the Google side.

Step 6: Enable user access

Section titled “Step 6: Enable user access”

  1. In the application settings, go to User Access

  2. Set Service status to ON for everyone (or pick specific organizational units)

    Google Admin service status toggle for the Tallyfy SSO app

Phase 2 - Enter your Google details in Tallyfy

Section titled “Phase 2 - Enter your Google details in Tallyfy”

Back in the Tallyfy SSO wizard (Settings > Organization > Security > SSO), move to the Enter IdP details step and provide the Google details you collected in Step 3.

  1. XML paste - if you downloaded Google’s IdP metadata, paste the file. Easiest option.

  2. Manual entry - enter the SSO URL, the Entity ID, and the Certificate instead.

    Tallyfy SAML configuration form with numbered identity provider fields

Google Workspace doesn’t publish a fetchable per-app metadata URL, so use XML paste or manual entry here.

Phase 3 - Test and enable in Tallyfy

Section titled “Phase 3 - Test and enable in Tallyfy”

  1. Run the wizard’s Test connection step and fix anything it flags.

  2. Once the test passes, click Enable to turn SSO on for your organization.

    Tallyfy Org Settings row to enable SSO and SAML

User provisioning and access

Section titled “User provisioning and access”

After you finish the integration:

  1. Share your org’s SSO login URL with your users (you’ll find it in the SSO wizard next to the connection).

    Tallyfy SAML settings showing SP Entity ID and login URL fields

  2. Confirm you’ve granted access to the SAML app in Google Workspace for users who need it.

  3. Existing Tallyfy users sign in through the shared SSO URL - no separate passwords required.

  4. New users from a verified domain are provisioned on first login when auto-join is on. Verify your domain under the Domains tab first. See Domain verification.

How the authentication flow works

Section titled “How the authentication flow works”

Here’s the full SAML authentication flow after configuration is done.

How the authentication flow works

Key points:

  • Automatic provisioning - New users from a verified domain are created on first login (step 9a) when auto-join is on. No manual account setup needed.
  • Attribute mapping - The email, FirstName, and LastName attributes from step 7 control how accounts are created and matched.
  • Single authentication point - Users only authenticate with Google (steps 4-5), never entering Tallyfy passwords.

Troubleshooting

Section titled “Troubleshooting”

Running into authentication problems? Check these:

  • Has the user been granted access to the SAML app in Google Workspace?
  • Are the attribute mappings correct? Double-check the table above - case matters.
  • Is the user accessing Tallyfy through the right SSO URL?
  • Still stuck? Contact Tallyfy Support.

Directory sync with Google Workspace

Section titled “Directory sync with Google Workspace”

Google Workspace doesn’t push SCIM to custom SAML apps the way Okta, Microsoft Entra ID, and OneLogin do, so there’s no SCIM connector to wire up on the Google side here. For Google, the practical pattern is verified-domain auto-join: any Google user on a verified domain gets a Tallyfy account on first SSO login. If you want full directory sync (automatic deactivation and group-to-role mapping) and you also run Okta or Entra, configure SCIM provisioning through that provider instead.

Section titled “Related articles”
Get in touch
About Tallyfy