Assign SSO profile to organizational units or groups with the new SAML Partial SSO beta

What’s changing 

Currently, you can configure to authenticate your users using a third-party identity provider — this configuration applies to all users within your domain. Now, you have the option to specify groups or organizational units (OUs) to authenticate a subset of your users using Google. This feature is available beginning today as an open beta, which means you can use it without enrolling in a specific beta program. 

Who’s impacted 


Why you’d use it 

Currently, when you configure SSO with a third-party identity provider, the setting applies to your entire domain. However, there are some instances where you may want a subset of your users, such as vendors or contractors, to authenticate with Google instead. The Partial SSO beta gives you the flexibility to specify the authentication method for various users in your organization as needed.

Getting started

Image description: Within the Admin console, navigate to Security > Settings > Set up single sign-on (SSO) with a third party iDP > Manage SSO Profile assignments to specify a specific OU or Group who should identify using Google.

Rollout pace


  • Available to all Google Workspace and Cloud Identity customers