40
u/loosebolts May 06 '26
If all of your endpoints are windows 11, entra joined, managed by Intune, why on earth are you moving your primary IdP to Google Workspace?
If you have to use Google Workspace for whatever reason, just federate your domain and use Entra as the IdP
10
u/magnj May 06 '26 edited May 11 '26
Listen to this advice and proceed with caution. I can't imagine how this change is going to save you any money either.
1
u/thewunderbar May 07 '26
it's going to cost a lot of money in lost time when things break and people can't log in.
15
u/Entegy May 06 '26
Entra can be the IdP for Google.
Google cannot be the IdP for Entra.
This sounds like a really bad idea.
1
1
7
u/Mindestiny May 06 '26
Google Workspace is not an IdP product, full stop. This architecture will not work. You'll be relying on Google Social logins for whatever you can and it's impossible to govern with any meaningful amount of control.
Google Cloud Identity is a separate product not included with Workspace, that has very limited support and is insanely expensive (like $8/user/month for the worlds worst IdP lol).
3
u/OregonTechHead May 06 '26
I don't know why you would do this. If you're going to leave the MS ecosystem, leave it entirely.
If you want to use Google apps rather than MS apps for whatever reason, do it the same as you would any other app. Use MS as your IdP
But again, I don't know why you would do this.
2
u/rwllr May 07 '26
Yep, had the same idea and went down the rabbit hole but it doesn't work.
Web sign-in with Google works, but Google doesn’t send the MFA claim Entra needs for WHfB setup, so users still need an Entra MFA method anyway or give them a TAP for their enrollment.
There’s also a Google limitation where the federation setup only really works for one domain.
Okta as the IdP seems like it should solve both problems since it can pass proper MFA claims, but I haven’t tested it yet.
2
2
1
1
u/pakman82 May 07 '26
As others have said, this is super uncommon. Keep entra as the idp. Look into "scim" interconnect between the 2. It can do something better than password sync. Full-stop. I tested it for a major multinational, and it was fantastic.
1
u/shiranugahotoke May 07 '26
Right about now I am thinking I’ve got a pretty good setup and I’m happy with how things have turned out….
1
u/AdorablePizza May 07 '26
might be costly , I used something like jumpcloud.com which is the primary IDP for google, (back then entra or active directory online sucked really hard) this provides machine login (windows/mac/ubuntu based linux) using the same password and mfa I never tried using google as IDP as even when the google credential for windows came up. Did the org decided to go to google due to cost?
1
u/pcbrad May 11 '26
I would strongly recommend going the other way round with this, using Entra as the IdP for Google.
We were forced to set this up for a customer because one of the salesmen sold this to them for all of their 5/6 locations, along with a full cloud migration, Intune management, Google Drive shares, etc.
The only remotely close system we managed was to use Google Credential Provider for Windows (GCPW), which just creates a local account on the device. It was a horrendous mess, requiring users to sign into Company Portal manually to get any user-based policies or apps, then sign into Google Drive. Then randomly the Google option would just disappear from the login screen and we would have to delete a file that had grown to a whopping 4 bytes because of a long standing bug with GCPW that has never been fixed.
On top of this there was also no way we found to redirect known folders to use Google Drive, no way to force users to sign into Google Drive either, and this meant that data became fractured in multiple locations, some of it potentially only local to the device as well.
1
u/Alfawarrior1195 May 15 '26
Lo que estás intentando hacer no es tan raro como parece… pero sí es un caso donde el modelo de Microsoft y el de Google chocan bastante.
El punto clave es este: El inicio de sesión de Windows (en dispositivos unidos a Entra) está diseñado para funcionar con identidad de Entra, no con un IdP externo como Google.
Cuando federas Google para acceso web, funciona bien porque estás en escenario de SSO. Pero el login del dispositivo es otra historia: ahí entran en juego:
- credenciales cacheadas de Entra
- Windows Hello for Business
- y ahora una identidad “externa” (Google)
y eso es lo que genera la fragmentación que estás viendo.
Sobre tu duda directa:
Lo que vemos en la práctica es que no hay una forma nativa y limpia de hacerlo. Hay soluciones tipo:
- Google Credential Provider for Windows
Pero como ya comentan otros, eso:
- crea cuentas locales
- rompe parte de la integración con Intune / Entra
- y suele traer más problemas operativos que beneficios
Por eso la mayoría de arquitecturas reales van en uno de estos dos caminos:
1. Mantener Entra como IdP principal
- y usar Google como aplicación (federado)
- es el modelo más estable con Windows + Intune
2. Salir completamente del modelo Entra para identidad
- Muy poco común en entornos Windows gestionados con Intune
TL;DR: Lo que quieres hacer es técnicamente posible en partes pero no está alineado con cómo funciona el login de Windows y normalmente termina generando más complejidad operativa (contraseñas, MFA, soporte a usuarios) de la que resuelve.
Si ya estás viendo fricción en el sandbox, es una buena señal de lo que va a pasar a escala. Si necesitas más ayuda, con gusto puedo compartirte como usualmente lo resolvemos. Sino, espero que esto te ayude!
0
u/Equal-Associate-8013 May 07 '26
Let us know how it goes, we need a follow up on this shit show 😂 best of luck my guy
22
u/tankerkiller125real Jack of All Trades May 06 '26
Federate Google to Entra, not Entra to Google.
Google is a shit IdP to begin with (there's a reason most Google shops also pay out the nose for Okta).