# Google Workspace

Connect DatoCMS to Google Workspace so your team can sign in with their Google accounts over SAML, and their Google groups map to DatoCMS roles.

### Prerequisites

-   Single Sign-On is only available for Enterprise plans.
    

### Configuration Steps

Enter your **Google Admin console** (at admin.google.com), go to [Apps \> Web and mobile apps](https://admin.google.com/ac/apps/unified) and click **Add App \> Add custom SAML app**.

(Image content)

Name your application **DatoCMS** and click **Continue**:

(Image content)

Download the IdP metadata by clicking on the **Download Metadata** button (you'll need this later), and click **Continue:**

(Image content)

Fill in some fields using the information present in the **Settings \> Single Sign-On \> Settings** section of your DatoCMS project:

-   **ACS URL:** Copy the value of the "Assertion Consumer Service (ACS) URL" field
-   **Entity ID:** Copy the value of the "Service Provider Metadata URL / Entity ID" field
    
-   **Name ID format:** EMAIL
    

You can leave the rest of the settings as they are, and then click **Continue**:

(Image content)

In the next section, copy the following mappings:

-   First name: `firstName`
-   Last name: `lastName`
    

(Image content)

If you want to activate group mapping as well, then select the groups you want to pass in the SAML assertion, and specify `datocmsGroups` as the **App attribute**:

(Image content)

Click **Finish**, then activate the App by clicking on **User Access**, and selecting **ON for everyone**:

(Image content)

Open the **IdP metadata file** that we previously downloaded in any text editor.

Now, return to the **Settings \> Single Sign-On \> Settings** section of your DatoCMS project, select **By passing the metadata XML**, and paste the complete content of the file in the **Identity Provider Metadata XML** field:

(Image content)

Make sure to also specify the default role collaborators will be assigned to (learn more about this field in the "Mapping groups to DatoCMS roles" section below):

(Image content)

Press the **Save settings** button in DatoCMS.

#### Mapping groups to DatoCMS roles

When a user logs in using SSO, the groups they belong to will appear in the **Settings \> Single Sign-On \> Groups** section in DatoCMS.

In this section you can assign a specific DatoCMS role to each group:

(Image content)

Once configured, the following rules will apply:

-   The group's role will be applied to every user belonging to it;
-   In case a user belongs to multiple groups, the first group in the list will be the one to win. You reorder groups with drag & drop to customize their priorities;
    

In case a user does not belong to any group, the default role specified in the **SSO Settings** will be used:

(Image content)

#### Support and Troubleshooting

For any issues, please [contact our support](https://www.datocms.com/support.md) to get customized help.

## Related content in "Enterprise Apps"

- [Connecting to Enterprise Apps](https://www.datocms.com/docs/enterprise-apps.md)
- [AWS S3](https://www.datocms.com/docs/enterprise-apps/aws-s3.md)
- [Azure Blob Storage](https://www.datocms.com/docs/enterprise-apps/azure-blob-storage.md)
- [Google Cloud Storage](https://www.datocms.com/docs/enterprise-apps/google-cloud-storage.md)
- [Cloudflare R2](https://www.datocms.com/docs/enterprise-apps/cloudflare-r2.md)
- [Okta](https://www.datocms.com/docs/enterprise-apps/okta-sso.md)
- [Microsoft Entra ID](https://www.datocms.com/docs/enterprise-apps/microsoft-entra-id.md)
- [OneLogin](https://www.datocms.com/docs/enterprise-apps/onelogin-sso.md)
- [Google Workspace](https://www.datocms.com/docs/enterprise-apps/google-workspace.md)