# SSO with Google
URL: https://docs.awellhealth.com/docs/administer-and-secure/sso-with-google

> For the complete documentation index, see [llms.txt](https://docs.awellhealth.com/llms.txt).



With Google as the identity provider (IdP), people sign in to Awell with their Google credentials. The
connection is a custom Security Assertion Markup Language (SAML) app in Google Workspace.

## Before starting [#before-starting]

* **Google Workspace Admin Console access** with administrative privileges.
* **An Awell account with permission to configure single sign-on (SSO).** Awell provides an **ACS URL**
  and an **Entity ID** on [request](/docs/administer-and-secure/set-up-sso).

Request SSO from Awell first; step 1 can't be completed without the ACS URL and Entity ID.

## 1. Set up a SAML app in Google Workspace [#1-set-up-a-saml-app-in-google-workspace]

Google's own guides cover setting up a custom SAML app and configuring the SSO profile for the
organization. Use the ACS URL and Entity ID Awell provided.

## 2. Gather the SAML configuration details from Google [#2-gather-the-saml-configuration-details-from-google]

Collect the details Google generates for the app, including its metadata.

## 3. Assign users in Google Workspace [#3-assign-users-in-google-workspace]

Assign the app to the users and groups who should have Awell access.

Once SSO is live, this becomes the ongoing access process: granting Awell access means assigning someone
here, and with [just-in-time provisioning](/docs/administer-and-secure/single-sign-on) their Awell profile
is created on first login.

## 4. Provide the Google metadata to Awell [#4-provide-the-google-metadata-to-awell]

Send the metadata to Awell, who complete the connection on their side.

## Awell completes the connection [#awell-completes-the-connection]

Awell finishes the configuration and confirms when SSO is live. Test with one user before assigning
everyone.

## Next steps [#next-steps]

Once people can sign in, assign them the right
[roles](/docs/administer-and-secure/roles-and-permissions). SSO controls who can log in, and roles control
what they can do.