Your staff can sign in to SDS Manager with their Google Workspace account. You set this up once: add SDS Manager as a custom SAML app in the Google Admin console, then upload Google's metadata file in SDS Manager. It takes about 20 minutes.

Before you start, you need:

• A Google Workspace super administrator account.
• An SDS Manager subscription that includes Single Sign-On (SSO), and an SDS Manager Admin account.
• Staff who already have an SDS Manager user with the same email as their Google account. Alternatively, turn on automatic user creation in step D.

A. Create the SDS Manager app in Google

1. Sign in to the Google Admin console as a super administrator.
2. Go to Menu → Apps → Web and mobile apps.
3. Click Add app → Add custom SAML app.
   • [Screenshot 1: Web and mobile apps, "Add app" menu open, "Add custom SAML app" highlighted]
4. Enter SDS Manager as the app name. You can upload the SDS Manager logo as the icon. Click Continue.
5. On the Google Identity Provider details page, click Download metadata and save the file (for example GoogleIDPMetadata.xml). You will upload it to SDS Manager in step D.
6. On the same page, look at the SSO URL. It ends with idpid= followed by an ID, for example C01abc2de. This is your Google IdP ID. You will use it as your Application ID in the next steps.
7. Click Continue.

B. Enter the service provider details

On the Service provider details page, enter these values. Replace <Application ID> with your Google IdP ID from step A6, for example C01abc2de.

The Entity ID must be exactly spn: followed by your Application ID, with no spaces. The Start URL lets users open SDS Manager from the Google apps menu. Click Continue.

C. Map the user attributes and roles

SDS Manager finds the user by the emailAddress attribute, so that mapping is required. On the Attribute mapping page, click Add mapping for each row:

Optional: assign roles with Google groups. SDS Manager can give new users a role based on their Google groups.

1. In Google, create groups named after the SDS Manager roles: Admin, Admin Light, Staff and No access. Add users to them.
2. Under Group membership (optional), select those groups and enter groups as the App attribute.
3. Click Finish.

The group only sets the role when SDS Manager creates a user at their first sign-in. Users who already exist keep their current role. Owner and Read only cannot be assigned through SSO.

D. Configure SDS Manager

Google gives the metadata only as a file, not as a URL, so upload it as an XML file here.

1. Sign in to SDS Manager as an Admin and open Administration → Settings → Single Sign-On.
2. Under Federation Metadata Document, choose XML file, click Choose file and select the metadata file from step A5.
3. In Application (Client) ID, enter your Application ID without spn:, for example C01abc2de.
4. In Email attribute mapping, enter emailAddress.
5. Turn on Enable for users.
6. Optional: turn on Auto-create user with role and pick the default role. SDS Manager then creates a user the first time someone signs in.
7. Optional, if you set up groups in step C: turn on Use SSO role. Leave Role attribute mapping empty; SDS Manager finds groups on its own.
8. Click Save configuration.
9. Check that the SSO Login URL shown on the page is the same as the Start URL you entered in step B. If it is different, copy it into the Start URL field in Google.

E. Turn the app on for your users

A new custom SAML app starts switched off, so no one can use it until you turn it on.

1. In the Google Admin console, go to Apps → Web and mobile apps and open SDS Manager.
2. Click User access.
3. Choose On for everyone, or turn it on for selected organizational units or groups only. Click Save.

Google says changes can take up to 24 hours, though they usually apply sooner.

F. Test, then share the sign-in link with staff

Test first:

• In SDS Manager, click Test on the Single Sign-On settings page and sign in with a Google account. The result page shows whether SDS Manager received the email.
• In Google, open the SDS Manager app and click Test SAML login.

How staff sign in. Any of these works:

1. The SSO Login URL (recommended). Share the SSO Login URL from step D9, for example as a bookmark or on your intranet. It opens Google sign-in directly, with no email step.
2. The Google apps menu. Staff click the app grid in any Google page and choose SDS Manager.
3. The SDS Manager login page. Staff click Sign in with Enterprise SSO, enter their work email and click Continue with SSO.

Troubleshooting

Still stuck? Contact SDS Manager support with the time of the attempt and the email that was used.

Internal: remove before publishing

This guide has not been run against a real Google Workspace tenant yet. It is based on the SDS Manager SSO code, the sign-in request decoded on staging on 2026-11-04, and Google's custom SAML app guide. The format follows the existing Okta and Microsoft Azure FAQs.

Screenshots to capture. You need a Google Workspace super admin for 1–5, 7 and 9, and an SDS Manager customer with the SSO subscription for 6 and 8:

• 1. Web and mobile apps → Add app → Add custom SAML app
• 2. Google Identity Provider details: Download metadata + SSO URL with idpid
• 3. Service provider details, filled in
• 4. Attribute mapping, three rows
• 5. Group membership with role groups, App attribute groups
• 6. SDS Manager Settings → Single Sign-On, XML file mode
• 7. User access, On for everyone
• 8. SDS Manager SSO test result
• 9. Google apps menu with SDS Manager

To confirm during the first real setup:

• Google sends group names (not group email addresses) in groups. If it sends addresses, role mapping will not match.
• The English labels on the SDS Manager SSO form match this guide. They were written from the translation keys, not from the live screen.
• Signing in from the Google apps menu works with the Start URL as the only RelayState.
• Using the Google IdP ID as the Application ID is the advice we want to give.