6. Set up user authentication  |  User management  |  Google Workspace Help Skip to main content User management Documentation Administrators Getting started Apps and integrations Set up and manage services Billing and subscriptions Data migration Data synchronization Device management Domain management Reports and monitoring Security and data protection User management Legal and compliance Support and troubleshooting Users Calendar Chat Cloud Search Gmail Groups Docs, Forms, Sheets, and Slides Drive Keep Meet Meet Hardware Sites Vids Developers Apps Script Marketplace Workspace APIs Training & business user guides Workspace Learning Center Google Skills Community Communities Workspace Admin Community Workspace Developers Community Support / English Deutsch Español – América Latina Français Indonesia Italiano Nederlands Polski Português – Brasil Svenska Tiếng Việt Türkçe Русский עברית العربيّة فارسی हिंदी বাংলা ภาษาไทย 中文 – 简体 中文 – 繁體 日本語 한국어 Sign in Administrators User management Admin console Contact us Overview Guides User management Overview Guides Documentation More Community More Support Add & manage users Options for adding users Add an account for a new user Add or update multiple users from a CSV file Use a third-party tool for quick mass provisioning Name guidelines for users and groups Avoid sharing an account among users Request additional Education licenses Delete or remove a user from your organization Suspend a user temporarily Restore a suspended user Restore a recently deleted user Archive former employee accounts Archive a single-user subscription Maintain data security after an employee leaves Choose a language for new users Change the default time zone for new users Impact on Google apps when changing a user's email address Let users buy add-ons Manage individual Google Cloud accounts Investigate user problems with log events Advanced user management User profiles & Directory Overview: Set up and manage the Directory Turn Directory on or off Control who users can find in the Directory Customize a directory for a team or group Hide a user from the Directory Hide Groups or domain shared contacts Add information to a user's Directory profile Add or change a user's profile photo Change a user's profile name Allow Directory users to change their profile and photo Create custom attributes for user profiles Troubleshoot custom user attribute errors Add advanced contact information Add shared external contacts to the Directory Bulk update user profiles with LDAP directory or API Let third-party apps access Directory data Email addresses & aliases Overview: Add additional email addresses for users Add or delete an alternate email address (email alias) Delegate a user's email address Set which email addresses show in the Directory Overview: Changing a Directory user's name or email address Administrator roles & privileges About administrator roles Prebuilt administrator roles Administrator privilege definitions Assign specific admin roles Make a user an admin Create, edit, and delete custom admin roles Create an admin role for an organizational unit Remove Google Workspace administrator privileges Delete an administrator account View role assignments and privileges Security best practices for administrator accounts Set admin privileges to protect user privacy Designate users with analytics data access Designate users with temporary class access Passwords & account recovery Enforce and monitor password requirements for users Allow users to skip passwords at sign-in Prevent phishing attacks on your users Phishing prevention with Password Alert FAQ Set up password recovery for users Add recovery information for admins and users Allow super administrators to recover their password Allow users to add password recovery details Recovering administrator access to your account Account recovery information for Support Reset a user's password Restore a suspended Gmail account Unmanaged users Find and add unmanaged users Prevent creation of unmanaged user accounts Before using the transfer tool Use the transfer tool to migrate unmanaged users Use CSV to migrate unmanaged users Sync users with an external directory Sync data with your LDAP server Compare options for syncing directories Directory Sync Get started with Directory Sync System requirements Supported network connections Set up a VPC access connector Enable the Data Connectors API Add, edit, or remove an external directory Set up user sync Set up group sync Run a sync Replace the domain name for synced users Update user or group settings Check log events for Directory Sync Troubleshoot Directory Sync Directory Sync FAQ Google Cloud Directory Sync (GCDS) About Google Cloud Directory Sync GCDS best practices What is synced? System requirements 1. Download and install GCDS 2. Prepare your LDAP directory 3. Organize LDAP data 4. Authorize your Google Account 5. Allow access to URLs and ports What is Configuration Manager? Set up your sync with Configuration Manager Learn more about Configuration Manager options Work with configuration files Use LDAP search rules to synchronize data Omit data with exclusion rules and queries Use limits with GCDS Maintain different user attributes during a sync GCDS synchronization options Perform a manual synchronization Synchronize using the command line Schedule automatic synchronizations Manage and assign licenses Archive or unarchive users Sync groups and users to a Cloud Search identity source Manage conflicting accounts with GCDS Troubleshoot certificate-related problems GCDS error messages Troubleshoot common GCDS issues GCDS FAQ What GCDS information do I need before contacting support? Update GCDS GCDS reports and notifications Google Cloud Directory Sync release notes Inbound SCIM Get started with Inbound SCIM Manage connections Troubleshoot Inbound SCIM Sync user passwords with Microsoft Active Directory About Password Sync How does Password Sync work? 1. Get ready to use Password Sync 2. Choose your authentication method 3. Create a service account 4. Download and install 5. Configure Password Sync 6. Set up user authentication 7. Have users change their AD passwords Install and configure Password Sync from the command line Change a Password Sync configuration from the command line How to exclude some users from Password Sync Troubleshoot Password Sync Use logs to troubleshoot Authentication errors in Password Sync logs Password Sync error codes and messages Some user passwords aren't syncing Upgrade Password Sync Password Sync release notes Administrators Getting started Apps and integrations Set up and manage services Billing and subscriptions Data migration Data synchronization Device management Domain management Reports and monitoring Security and data protection User management Legal and compliance Support and troubleshooting Users Calendar Chat Cloud Search Gmail Groups Docs, Forms, Sheets, and Slides Drive Keep Meet Meet Hardware Sites Vids Developers Apps Script Marketplace Workspace APIs Training & business user guides Workspace Learning Center Google Skills Communities Workspace Admin Community Workspace Developers Community Google Workspace Help Administrators User management Guides Send feedback 6. Set up user authentication Stay organized with collections Save and categorize content based on your preferences. As an administrator, you can use single sign-on (SSO) profiles to control how users authenticate when using Password Sync. How you set it up depends on the number of profile assignments. You're on step 6 of 7 Step 1: Provide instructions about password changes Have users contact you or another admin if they need to reset their managed Google Account password. For details, visit Set up password recovery for users. Create an internal webpage with instructions on how users should change their Windows password and not their managed Google Account password. Step 2: Set user authentication In the Google Admin console, go to Menu Security Overview. Go to Overview Requires having the Security Settings administrator privilege. Click Set up single sign-on (SSO) with a third party IdP. For Manage SSO profile assignments, go to the SSO profile column. If there's only one assignment that relates to SSO profile for organization, go to Option 1 to set authentication by your organization's SSO profile. If there are multiple SSO profiles and at least one assignment that relates to None (Users will sign in with Google), go to Option 2 to set authentication by SSO profile assignments. With this option, users that authenticate with SSO or with their Google credentials are directed to are directed to your internal webpage to change their Windows password. Option 1: Set authentication by organization's SSO profile This setting applies to your users even if you don't turn on SSO for your organization. Click SSO profile for your organization. For Change password URL, enter the URL of the internal webpage that you created in Step 1 to instruct users about changing their Windows password. Click Save. Option 2: Set authentication by SSO profile assignments Click Third-party SSO profile for your organization and note any identity provider (IdP) settings. Click SSO with third-party IDPs Add SAML Profile. Create a new SAML profile using the IdP settings from step 1. For Change password URL, enter the URL of the internal webpage that you created in Step 1 to instruct users about changing their Windows password. If there are no additional IdP settings to add, skip the remaining settings. Click Save. Click Back and change any profile assignments that reference SSO profile for organization to the new SAML profile. Changes can take up to 24 hours but typically happen more quickly. Learn more Click Third-party SSO profile for your organization and uncheck the Set up SSO with third-party identity provider box. Click Save. With this option, even if you have no SSO profiles (SSO profile assignments set to None in the Admin console) and turned off the SSO profile for your organization, your users are directed to your internal webpage to change their Windows password. Related topics Set up SSO for your organization Google Sites training and help Send feedback Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates. Last updated 2026-07-17 UTC. Need to tell us more? [[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2026-07-17 UTC."],[],[]] Try Google Workspace Boost your productivity with AI at no cost Admin Community Get answers from industry peers and experts Customer Care Learn about support options and services Documentation & training Help Centers Developer guides Learning Center Google Skills Tools Admin console Apps Script Dashboard Google Cloud console Support Admin Community Developers Community Customer Care Terms Privacy Manage cookies English Deutsch Español – América Latina Français Indonesia Italiano Nederlands Polski Português – Brasil Svenska Tiếng Việt Türkçe Русский עברית العربيّة فارسی हिंदी বাংলা ภาษาไทย 中文 – 简体 中文 – 繁體 日本語 한국어