Connect Google Workspace to Cloudflare One using a custom SAML app. You can send group membership during authentication and configure System for Cross-domain Identity Management (SCIM) to synchronize user updates and deprovision users.
This setup uses the SAML identity provider in Cloudflare One. The dedicated Google Workspace integration does not support SCIM.
- A Google Workspace super administrator account.
- Your Cloudflare One team name.
- For SCIM, access to Google's custom SCIM profiles beta in your Google Admin console.
You can find your team name in the Cloudflare dashboard ↗︎ under Zero Trust > Settings > Team name and domain > Team name.
Create a custom SAML app in Google Workspace ↗︎:
- In the Google Admin console ↗︎, go to Apps > Web and mobile apps.
- Select Add app > Add custom SAML app, enter an app name, and select Continue.
- Copy Google's SSO URL and Entity ID, and download the signing certificate. You will use these values when you add the SAML identity provider to Cloudflare One.
- In Service provider details, set both ACS URL and Entity ID to
https://<your-team-name>.cloudflareaccess.com/cdn-cgi/access/callback. - Set Name ID format to EMAIL and Name ID to the user's primary email address.
- In Attribute mapping, map the user's primary email address to an App attribute named
email. - (Optional) To send group membership to Cloudflare One, under Group membership (optional), search for and select the Google groups to include. Set App attribute to
groups. Use this exact name so Cloudflare recognizes the values as IdP groups rather than a custom SAML attribute. - Select Finish, then turn on the app for the users who will authenticate to Cloudflare One.
Google includes only the selected groups that the signing-in user belongs to, directly or indirectly. You can select up to 75 groups. If you rename a group in Google, select it again in the group membership mapping. Refer to Google's group membership mapping documentation ↗︎.
Group membership is sent in the SAML assertion when a user authenticates. This mapping is separate from SCIM user provisioning; selecting groups as a SCIM provisioning scope does not send their memberships to Cloudflare One.
- In the Cloudflare dashboard ↗︎, go to Zero Trust > Integrations > Identity providers.
- Select Add new identity provider and select SAML.
- Choose a descriptive name for your identity provider.
- Enter Google's SSO URL, Entity ID, and signing certificate in Single Sign on URL, IdP Entity ID or Issuer URL, and Signing certificate, respectively.
- Under Optional configurations, set Email attribute name to
email. If you configured group membership mapping, addgroupsto SAML attributes. - Select Save.
For additional SAML settings or Terraform configuration, refer to Generic SAML 2.0.
Test the IdP integration with a user who has access to the SAML app. If you configured group membership mapping, use a member of a mapped group and confirm that the returned identity includes the expected groups.
Google's custom SCIM profiles support automated user provisioning for SAML apps. The feature is in beta and must be available in your Google Admin console. Turn on the custom SAML app for at least one user before configuring SCIM.
-
In the Cloudflare dashboard ↗︎, go to Zero Trust > Integrations > Identity providers.
-
Find the Google Workspace SAML integration and select Edit.
-
Turn on Enable SCIM.
-
(Optional) Configure the following settings:
- Enable user deprovisioning: Revoke a user's active session when they are removed from the SCIM application in Google Workspace SAML. This will invalidate all active Access sessions and prompt for reauthentication for any Cloudflare One Client session policies.
- Remove user seat on deprovision: Remove a user's seat from your Cloudflare One account when they are removed from the SCIM application in Google Workspace SAML.
- SCIM identity update behavior: Choose what happens in Cloudflare One when the user's identity updates in Google Workspace SAML.
- Automatic identity updates: Automatically update the User Registry identity when Google Workspace SAML sends an updated identity or group membership through SCIM. This identity is used for Gateway policies and Cloudflare One Client device profiles; Access will read the user's updated identity when they reauthenticate.
- Group membership change reauthentication: Revoke a user's active session when their group membership changes in Google Workspace SAML. This will invalidate all active Access sessions and prompt for reauthentication for any Cloudflare One Client session policies. Access will read the user's updated group membership when they reauthenticate.
- No action: Update the user's identity the next time they reauthenticate to Access or the Cloudflare One Client.
-
Select Regenerate Secret. Copy the SCIM Endpoint and SCIM Secret. You will need to enter these values into Google Workspace SAML.
-
Select Save.
The SCIM secret never expires, but you can manually regenerate the secret at any time.
Turn on Enable user deprovisioning if Google deprovisioning events should revoke active Access sessions. Google's configured deprovisioning delay still applies.
- In the Google Admin console ↗︎, go to Apps > Web and mobile apps and select the SAML app you created for Cloudflare One.
- Under Autoprovisioning, select Configure auto-provisioning. Enter the Cloudflare SCIM Secret in Access token, then enter the SCIM Endpoint in Endpoint URL.
- Review the discovered attribute mappings. Ensure that SCIM
userNamemaps to the same primary email address used for SAML authentication. - (Optional) Limit provisioning to specific Google groups. This scopes which users are provisioned; it does not configure group membership synchronization. Users must also have access to the SAML app. Google excludes group members from secondary domains or outside your organization from provisioning.
- Choose the deprovisioning actions and delays for users whose app access is turned off or whose Google accounts are suspended or deleted. Google can deactivate users or send a hard-delete request after the configured delay.
- Choose a dedicated test user who has already authenticated to Cloudflare One and select Test Connection. This test creates, updates, and deletes the test user at the SCIM endpoint. Review the results before selecting Finish.
- Return to the app's Autoprovisioning settings and set the toggle to Active. Finishing setup alone does not start provisioning.
This integration covers user lifecycle updates. Configure the SAML groups attribute separately for group-based policies. Do not rely on SCIM provisioning scope to deliver group membership changes or revoke sessions when a user changes groups.
To check if user identities were updated in Cloudflare One, view your SCIM provisioning logs.