> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tuple.app/llms.txt
> Use this file to discover all available pages before exploring further.
# Google Workspace
> How to configure SAML SSO with Google Workspace for your Tuple team
export const provider_1 = "Google Workspace"
export const children_0 = undefined
export const provider_0 = "Google Workspace"
This guide walks through configuring SAML SSO with Google Workspace as your identity provider.
Email addresses in {provider_0} and Tuple must match exactly. For example, `dev+tuple@company.com` does not match `dev@company.com`. Verify your team's email addresses before enabling SSO.
Tuple falls back to the SAML NameID when no email attribute is present in the response, so if your provider's NameID defaults to something other than email (such as a username or UPN), set it to the user's email address as well.
Sign in to your Google Workspace Admin console. Navigate to **Apps > Web and mobile apps > Add app > Add custom SAML app**.
Name the app "Tuple" and optionally upload an icon, which you can [download here](https://s3.wasabisys.com/tuple/images/tuple-sso.png).
You are shown the Google Identity Provider details. Copy the values from this screen:
Navigate to the **Settings** tab of the [team management dashboard](https://production.tuple.app/team_management/settings).
Only [team owners](/team-management/team-owner-and-managers) can enable SAML. To find out who your team owner is, check [your profile](https://production.tuple.app/profile#team).
Under **Sign-in methods**, set **Required Authentication Provider** to **SAML SSO**. The **Update SAML Configuration** form appears:
Fill in the values with your {provider_1} metadata:
{children_0}
Select the **Email Domain** that SAML should apply to. Only domains with confirmed team members are available.
Click **Save as draft**. Your draft is saved as a **Pending Update** alongside your current sign-in method, so no one on your team is affected yet.
Click **Test** to verify the configuration end-to-end. Tuple signs you in through {provider_1} so you can confirm that authentication succeeds before the change affects anyone else on your team.
Once the test succeeds, click **Publish** to make the configuration live. Active Tuple sessions persist, but new sign-ins are routed through {provider_1}.
Use **Edit** to tweak the draft, or **Discard** to throw it away without publishing.
Return to the Google Workspace Admin console and fill in the following fields:
**ACS URL**
```
https://production.tuple.app/users/saml/auth
```
**Entity ID**
```
https://production.tuple.app/users/saml/metadata
```
Tuple requires two additional attributes: `first_name` and `last_name`.
After finishing the install wizard, click **Test SAML Login** to verify the configuration.
