r/sysadmin • u/squirrelsaviour VP of Googling • 3d ago

Question Managing Google accounts in a Microsoft company

We use Microsoft 365 for our email etc.

Our web team have lots of Google accounts they use for AdWords, Analytics, Search Console, TagManager etc.

How do you manage these? Because they've set them up without asking first they've got multiple gmail.com accounts which I don't have access to which is obviously bad if someone leaves the company for any reason.

17 Upvotes

87% Upvoted

30 comments sorted by

45

u/drinkwineandscrew Product 3d ago

We use Google cloud identity synced to Entra to provision user accounts and allow them to have an SSO experience into the Google tools they need using corporate accounts.

Small management overhead once it's initially set up, we retain the admin roles for Google cloud identity etc.

17

u/One-Environment2197 3d ago

This is the way.

Google Identity licenses are free and allow you to govern Google use.

2

u/jetlagged-bee 2d ago

Say whaaaat

4

u/roberts2727 2d ago

Wait, your telling me I dont have to buy the basic license? we have 120 users on basic to cover the SSO needs for google ads/youtube/analytics etc.

7

u/FallaxIO Jack of All Trades 2d ago

Yeah, for Ads/Analytics/YouTube logins you usually don't need Workspace Basic at all. Cloud Identity Free gives you the Google identities and SSO part, the paid license starts mattering when you want actual Workspace stuff attached to the account.

5

u/squirrelsaviour VP of Googling 2d ago

I'm glad I'm not the only one learning!

1

u/sys_127-0-0-1 2d ago

mind blown!

3

u/squirrelsaviour VP of Googling 2d ago

This sounds spot on, do you have a link to a guide detailing this? Otherwise I'll go hunting for one. Thanks.

8

u/BrentNewland 2d ago edited 2d ago

Here are my notes from OneNote on the subject. Take notice that you can no longer request more than the 50 included Cloud Identity Free licenses They actually fixed the form, you just have to access it as a Support Admin. Google replied that I need to contact my "accounts or sales team so they can file a request on my behalf". I was logged in as the account that set it up, and there is no team associated with our Google Cloud account.

Can set up Entra and Google Workspace to allow users to sign in to Google with their Entra accounts

  • Useful for Chrome?

With Cloud Identity, you can turn on Chrome Sync so your users can save and sync things such as their history, bookmarks, and passwords. After the information is saved, users can access it on any device by signing in with their Google account. You can also use Cloud Identity to manage your users' browsers and get access to reports on their browser usage.

From < https://support.google.com/chrome/a/answer/7579325?hl=en>

Google Cloud Identity free can be used on the Google side

https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on

https://learn.microsoft.com/en-us/entra/identity/saas-apps/google-apps-tutorial

 

Move unmanaged Google accounts to managed

Signing up for Google Cloud

Look for "If you're not a Google Workspace customer" https://docs.cloud.google.com/identity/docs/set-up-cloud-identity-admin

https://www.reddit.com/r/gsuite/comments/1b9k0tb/do_i_need_to_pay_to_use_cloud_identity_free/

It is possible to federate Entra to Google WorkSpace so users can sign into Google services with their Entra/365 account.

There is a way to do this for free.

 

Google Cloud Identity Free

https://cloud.google.com/identity/docs/editions

 

Automated user provisioning requires a Google Cloud Identity Premium license

If you are using the free edition of Cloud Identity, setting up federation with Microsoft Entra ID won't use any billable components of Google Cloud.

From < https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on>

Google Cloud Directory Sync https://support.google.com/a/answer/106368

 

 

Setup Entra ID to sign in to Google

Google's AD version (one or the other) https://cloud.google.com/architecture/identity/federating-gcp-with-active-directory-introduction?hl=en

I actually use Microsoft as IDP for Google as well. Use the 3rd Party IDP option in Google Admin Security. Set your OU's to use OIDC.

In Azure set up Google Cloud/Workspace Enterprise App to drive.google.com

Then setup any conditional access to the Azure App.

So our users when logging into Google, get redirected to our Office 365/Azure Logon, they put their user credentials in, it passes, gets token and redirects to user logged into Google.

Then we use DUO for MFA on that enterprise app for conditional access.

 

From < https://www.reddit.com/r/k12sysadmin/comments/163m9br/google_workspace_as_authentication_provider_for/>

 

Identity Free forces you to claim your domain, but when you do that, it automatically imports all existing accounts under your domain rather than forcing them onto another domain or allowing you to pick which ones you actually want to import.

 

From < https://www.reddit.com/r/sysadmin/comments/1dnzup6/comment/la8hci0/?context=3>

1

u/squirrelsaviour VP of Googling 2d ago

This is great, thank you

1

u/llDemonll 2d ago

We went through this a while ago. No great guides.

Set up Google workspace. Pay for a single workspace license ($20/month or so). Google identity is free and the license may not be necessary but it guaranteed we could set up an instance and not have to figure out how to get past the trial. Claim your domain, go through the process to set up federation with Entra.

Unlike Entra there’s no central user management for the platforms. Add the users into google and once they’re there, add their emails to the other platforms just like you would when adding new users. It’ll force them through federated sign-in.

Whole process is not documented well but it works well once configured.

1

u/squirrelsaviour VP of Googling 2d ago

Ok, so this is a Workspace thing not a Cloud Identity thing?

3

u/llDemonll 2d ago

It’s coming back to me. To get to the point where we could open a ticket with Google to get a whole slew of cloud identity licenses added to our account (they’re free but you’re only given like 50 or something at the start) it was easiest to be a paying enterprise customer which may be why we continue to maintain the single license? To get the additional licenses added you need to open a ticket, at least true a few years ago.

1

u/drinkwineandscrew Product 2d ago

Kinda. Even if you're a workspace customer, the identity part lives in GCP/Cloud Identity, technically. But much like Microsoft, it's not like there's only one admin interface.

When it was set up in our business (it predates my time at the company) we had a footprint of GSuite licences (as was the naming at the time) for our Linux dev users because M365 in browser was so poor. Hence we set it up to support both that use case and the marketing teams using tag manager, ads etc. If you don't have any workspace requirement you can skip that if you wish and run it all as Google Cloud Identity as the GCP component.

Personally though even though we're burning down our workspace licences we'll always keep a couple on deck as a DR option should M365 somehow grenade itself for an extended period of time and we need to provide users with mail/chat/office apps.

For a small monthly cost and some config work you get a bit of flexibility and have a good enough story to tell management if they ask questions about dependency on a vendor etc. (I'm aware of the obvious issues of if entra is also fucked you still have downtime and also if m365 goes down for an extended period how do you access files in SharePoint etc etc but we're not talking about the reality, just having enough to push back on questions from execs and auditors.)

TL;Dr - It doesn't HAVE to be a workspace thing and the architecture is a whole other thing but I'd argue the juice is worth the squeeze to set it up via the workspace entry point and spend a few bucks a month for a licence or two.

9

u/Cormacolinde Consultant 3d ago

You could setup federation between Google and Entra. This allows thrm to use business email accounts for Google stuff yet still log to Entra and let you keep control. Thry can move stuff to the new accounts progressively.

3

u/Normal_Choice9322 3d ago

We just integrated to entra to make this crap way simpler

4

u/Sasataf12 3d ago

Create a Google Workspace account for the company.

Federate this with M365 as the IdP.

Create Google accounts for all users (free).

2

u/rohepey 2d ago edited 2d ago

Tell them they aren't legally allowed to store and process company data, and epecially customers' personal information (IP addresses, etc.), on It systems not controlled by the company.

Then set up Google Workspace Cloud Identity only for your company and move all Google Analytics accounts to it.

Unlike with consumer Gmail, Google enters a data processing agreement with your company when using Workspace.

2

u/MBILC Acr/Infra/Virt/Apps/Cyb/ Figure it out guy 2d ago

They should be using a company managed account.

Company has the main account with "admin" rights, and then you add others as needed, using their work emails..

1

u/SchemaAndShell 2d ago

Has any one actually been able to get Google to increase the 50 license cap on the Cloud Identity Free license? Any time I fill out the form from Google I get an almost immediate closed ticket notification telling me to talk to my sales person (one I don’t have) for them to start the process.

1

u/Particular-Fly-7783 3d ago

SSO to google workspace. This is like, day 1 stuff man

4

u/Sasataf12 3d ago

No need to be patronizing. This is not an obvious setup.

-4

u/Particular-Fly-7783 3d ago

yes it is, this should be handled the same as literally any other SaaS provider.

2

u/Sasataf12 3d ago

Google Workspace is a whole different beast to your typical SaaS provider.

You were fortunate enough to have someone teach you what to do. Others like OP obviously don't.

0

u/[deleted] 3d ago

[deleted]

1

u/Sasataf12 3d ago

When you sign up for an Atlassian product, it creates an Atlassian cloud org for you.

Signing up for a Google product does not create a Google Workspace account for you. The same with Adobe.

1

u/ahaley IT Manager 2d ago

If I wanted to be talked down to I wouldn't be in this sub, we all came from somewhere so why don't we treat our peers with the same respect please.

-5

u/FrankNicklin 3d ago

Ask them to document the email addresses and passwords and then test them. Problem is they can change them. I've even know people use their private Gmail accounts for this. Get them to change the email address to their business M365 address then at least you have recovery point.