Centralize your team’s access to Unblocked by connecting it to Google Workspace.

​
Configure Single Sign-On

Follow the steps below to configure single sign-on for Google Workspace.
1

Go to the Unblocked SSO Settings

Navigate to the Settings section of the Unblocked web app. Under Team Settings, select Security. Locate the Single Sign-On section and click Configure.SSO Configuration
2

Create a Google SAML App

From your Google Workspace Admin dashboard, go to Web and mobile apps. Then, from the Add app dropdown, select Add custom SAML app.
3

Enter App details

Enter “Unblocked” as the app name and click Continue.
4

Copy Google Identity Provider details into Unblocked

Copy the following three values from the SAML application into the Configure SSO form in Unblocked:
  • SSO URL
  • Entity ID
  • Certificate
5

Configure SAML Settings

On the Service provider details page, enter the following:
  • ACS URL: provided from Unblocked
  • Entity ID: provided from Unblocked
  • Name ID format: EMAIL
  • Name ID: Basic Information > Primary email
6

Configure Attribute Mapping

Enter the following three attribute statements:
Google Directory AttributeValue
Primary emailemail
First namefirstName
Last namelastName
7

Click Finish

Click Finish to save your changes.
8

Assign Users

On the next page, assign users and groups to the Google SAML application to grant them access to Unblocked.

​
Enforce SSO

Once SSO is configured, you can enforce its use for your team. This means all team members will be required to sign in using your SSO provider. There are two enforcement options:
  • SSO Only: Users will be required to sign in to Unblocked using SSO. You may need to sign in with SSO before enabling this option.
  • SSO, a Source Code System, or Slack: Users can sign in using either SSO, their source code system (e.g., GitHub, Bitbucket, or GitLab), or Slack.
SSO Enforcement Options

​
Allowed Email Domains

Verifying a domain ensures that users who enter an email address from that domain on the Unblocked sign-in page are automatically directed to your SSO login. This creates a seamless login experience and routes users through the correct authentication flow. You can add multiple domains to enable SSO login detection for users with different email addresses. To verify a domain:
1

Add Domain

Click Add Domain and enter the domain name you want to verify.
2

Verify Domain

Unblocked will prompt you to add a TXT record to your DNS settings to complete the verification.
Once the domain is verified, any user who enters an email address matching that domain on the Unblocked sign-in page will see the SSO login option for your SAML provider. Verifying a domain only controls the visibility of the SSO login option and does not automatically grant access to your Unblocked team. Access to Unblocked is still managed through user and group assignments in your identity provider (IdP). To help your users easily recognize Unblocked in their identity provider dashboard, download the Unblocked logo for use in your SSO application. Unblocked Logo