> For the complete documentation index, see [llms.txt](https://docs.ilert.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ilert.com/users-and-access-management/single-sign-on/setting-up-sso-with-g-suite.md).

# Setting up SSO with Google Workspace

Use Google Workspace accounts to sign in to ilert over OAuth 2.0 — the shortest single sign-on setup ilert offers.

If everyone in your organization signs in with a Google Workspace account, this is the fastest way to connect ilert: one field, no certificates, no application to create on the Google side.

Google Workspace was formerly called G Suite. The setup is the same either way.

**Prerequisites**

* The [Pro plan](https://www.ilert.com/pricing) or higher
* The **account owner** role in ilert — no other role can change login authentication
* A Google Workspace domain

## Connect ilert to your Google domain

{% stepper %}
{% step %}

### Open the single sign-on settings

In the sidebar, go to **Settings** → **Account settings** and open the **Single sign-on** tab.
{% endstep %}

{% step %}

### Choose Google

Select **Google (OAuth 2.0)** from the dropdown.
{% endstep %}

{% step %}

### Enter your domain

Type your Google Workspace domain into **Google Domain** — `acme.com`, not a URL.
{% endstep %}

{% step %}

### Save

Click **Save**. Users on that domain can now sign in through Google.
{% endstep %}
{% endstepper %}

To verify, open [app.ilert.com](https://app.ilert.com) in a private browser window, click **Login with SSO**, and enter your ilert subdomain. Google should take over the sign-in.

## Optional settings

| Setting                                    | What it does                                                                                                                                                                                                                          |
| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Provision new users on first sso login** | Creates the ilert user automatically on first successful sign-in, with the **Responder** role, instead of requiring an admin to invite them first. Requires a free seat.                                                              |
| **Allow login with username and password** | Leave it on and people outside your Google Workspace organization can still sign in with an ilert password. Turn it off to require Google sign-in for everyone except the account owner, who can still use a password in the web app. |
| **Longer sessions**                        | Keeps users signed in longer, as though they had ticked **Keep me logged in**.                                                                                                                                                        |

{% hint style="warning" %}
**Test before you turn off password login.**

With **Allow login with username and password** cleared, a wrong domain stops everyone signing in except the account owner, who can still use a password in the web app. Sign in through Google in a private browser window first, and only then clear the checkbox.
{% endhint %}

{% hint style="info" %}
**Revoking Google access does not delete the ilert user.**

Someone whose Google account you disable can no longer sign in through Google, but their ilert user stays active, with its seat, on-call shifts, escalation policy entries, API keys, mobile app sign-ins and open web sessions. An admin has to delete them in ilert; see [Offboard someone](/users-and-access-management/single-sign-on.md#offboard-someone).
{% endhint %}

## FAQ

### Can I use more than one Google Workspace domain?

No. ilert accepts a single domain. If your organization spans several, use [SAML](/users-and-access-management/single-sign-on/setting-up-sso-with-okta.md) instead, which does not have this limit.

### Can I pass roles and teams from Google?

No. Attribute-based [auto provisioning](/users-and-access-management/single-sign-on/auto-provisioning-users-and-teams.md) is a SAML feature — ilert has no way to read a role out of a Google sign-in. Users provisioned through Google always arrive as **Responder**, and an admin adjusts them afterwards.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ilert.com/users-and-access-management/single-sign-on/setting-up-sso-with-g-suite.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.