> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tuple.app/llms.txt
> Use this file to discover all available pages before exploring further.
# Google Workspace
> How to configure SAML SSO with Google Workspace for your Tuple team
export const provider_1 = "Google Workspace"
export const children_0 = undefined
export const provider_0 = "Google Workspace"
This guide walks through configuring SAML SSO with Google Workspace as your identity provider.
Email addresses in {provider_0} and Tuple must match exactly. For example, `dev+tuple@company.com` does not match `dev@company.com`. Verify your team's email addresses before enabling SSO.
Sign in to your Google Workspace Admin console. Navigate to **Apps > Web and mobile apps > Add app > Add custom SAML app**.
Name the app "Tuple" and optionally upload an icon, which you can [download here](https://s3.wasabisys.com/tuple/images/tuple-sso.png).
You are shown the Google Identity Provider details. Copy the values from this screen:
Navigate to the **Settings** tab of the [team management dashboard](https://production.tuple.app/team_management/settings).
Only [team owners](/team-management/team-owner-and-managers) can enable SAML. To find out who your team owner is, check [your profile](https://production.tuple.app/profile#team).
Under **Sign-in methods**, set **Required Authentication Provider** to **SAML SSO**. The **Update SAML Configuration** form appears:
Fill in the values with your {provider_1} metadata:
{children_0}
Select the **Email Domain** that SAML should apply to. Only domains with confirmed team members are available.
Click **Save as draft**. Your draft is saved as a **Pending Update** alongside your current sign-in method, so no one on your team is affected yet.
Click **Test** to verify the configuration end-to-end. Tuple signs you in through {provider_1} so you can confirm that authentication succeeds before the change affects anyone else on your team.
Once the test succeeds, click **Publish** to make the configuration live. Active Tuple sessions persist, but new sign-ins are routed through {provider_1}.
Use **Edit** to tweak the draft, or **Discard** to throw it away without publishing.
Return to the Google Workspace Admin console and fill in the following fields:
**ACS URL**
```
https://production.tuple.app/users/saml/auth
```
**Entity ID**
```
https://production.tuple.app/users/saml/metadata
```
Tuple requires two additional attributes: `first_name` and `last_name`.
After finishing the install wizard, click **Test SAML Login** to verify the configuration.
