You can let your team sign in to Aligned with their Google Workspace accounts by setting up single sign-on (SSO) through a SAML (Security Assertion Markup Language) app in the Google Admin console. A Google Workspace super admin creates a custom SAML app with the values Aligned support sends, then sends Google's SSO URL and certificate back to Aligned support. Aligned support completes the connection, runs a test sign-in with you, and then turns on SSO enforcement for your email domain. Google Workspace SAML SSO is available on the Aligned Enterprise plan.
Prerequisites & Requirements
Plan: Google Workspace SAML SSO is available on the Enterprise plan only.
Permissions: A Google Workspace super admin creates the SAML app in the Google Admin console. Aligned support sets up the connection and turns on SSO enforcement on the Aligned side.
Connection name: Before you start, ask Aligned support at [email protected] for your connection name. Aligned support creates the connection name, and it is not always your company name. Use the exact value support sends you. The connection name is case-sensitive.
Email domain: SSO covers one email domain per Aligned account. Each person's Google Workspace email must be the same as their Aligned account email.
Create the SAML app in Google Workspace
To create the SAML app in Google Workspace, sign in to the Google Admin console as a super admin and add a custom SAML app for Aligned.
Sign in to the Google Admin console with a super admin account.
Go to Apps → Web and mobile apps.
Click Add app → Add custom SAML app.
Enter Aligned as the App name, optionally upload the Aligned logo, and click Continue.
On the Google Identity Provider details page, copy the SSO URL and click Download next to Certificate. Keep both; you send them to Aligned support at the end.
Click Continue.
On the Service provider details page, enter Aligned's values, not the Google values from the previous page:
ACS URL:
https://auth.teamaligned.com/login/callback?connection=CONNECTION_NAMEEntity ID:
urn:auth0:alignedup:CONNECTION_NAMEName ID format: EMAIL
Name ID: Basic Information → Primary email
Replace
CONNECTION_NAMEwith the exact connection name Aligned support sent you. The connection name must be identical in the ACS URL and the Entity ID. Useauth.teamaligned.comexactly as shown; no other host works.Click Continue.
On the Attribute mapping page, click Add mapping and map all three attributes:
Primary email →
emailFirst name →
given_nameLast name →
family_name
Map the first name and last name as well as the email. Without them, new users appear in Aligned with no name.
Click Finish.
Turn on the Aligned app for your users
To turn on the Aligned app for your users, switch on user access in Google Workspace. New custom SAML apps are off for everyone until you turn them on, and users get an access denied error until you do.
In the Google Admin console, go to Apps → Web and mobile apps and open the Aligned app.
Click User access.
Select ON for everyone, or select the organizational units or groups that should sign in to Aligned and set them to ON.
Click Save. Google notes that changes can take up to 24 hours to apply to all users.
Send the details to Aligned support
To complete the Google Workspace SSO connection, email Aligned support at [email protected] with:
The SSO URL from the Google Identity Provider details page
The certificate as an attached file (.pem or .cer), not pasted text
Aligned support sets up the connection and schedules a test sign-in with you. After the test sign-in works, Aligned support turns on SSO enforcement for your email domain.
Sign in with Google Workspace SSO
To sign in to Aligned with Google Workspace SSO, go to the Aligned sign-in page, click Log in with SSO, and enter your work email. After SSO is enforced, signing in with an email and password, or with the Google or Microsoft buttons, also takes you to SSO.
To sign in from the Aligned app in your Google apps menu, ask Aligned support to enable it for your account first.
SSO enforcement
SSO enforcement in Aligned works like this:
Enforcement is off by default. Aligned support turns it on per account after a successful test sign-in. There is no setting for it in Aligned.
Once enforcement is on, password sign-in and the Google and Microsoft sign-in buttons stop working for your email domain and redirect to SSO.
To turn enforcement off, contact Aligned support.
Enforcement turns off automatically if your account moves to a plan other than Enterprise.
Limitations
Google Workspace SSO in Aligned has these limitations:
SSO covers one email domain per Aligned account, matched exactly. Users with an email on a second domain are not covered.
Automatic user provisioning (SCIM) is not available with Google Workspace. Aligned creates users when they first sign in with SSO.
Troubleshooting & FAQ
Users get an access denied error from Google
An access denied error from Google means user access for the Aligned app is off for that person. To fix the error, follow Turn on the Aligned app for your users and include the person's organizational unit or group. Changes can take up to 24 hours to apply.
New users appear with no name
New users appear with no name when the first name and last name attributes are not mapped. To fix it, open the Aligned app in the Google Admin console, go to Attribute mapping, and map First name → given_name and Last name → family_name.
A user signs in and sees an empty account
A user lands in a new, empty Aligned account when their Google Workspace email is different from their Aligned account email. To fix it, contact Aligned support with both email addresses.
Sign-in fails with another error
If Google Workspace SSO sign-in fails with any other error, first check that the connection name is identical in the ACS URL and the Entity ID. If the error continues, email Aligned support at [email protected] with a screenshot of the error, the email address of the user who tried to sign in, and the time of the attempt.
What happens to users who already have Aligned accounts?
Users who already have Aligned accounts keep their Rooms, content and roles after Google Workspace SSO is set up. Aligned matches the Google sign-in to the existing Aligned user with the same email address.
What happens when someone without an Aligned account signs in?
When someone without an Aligned account signs in with Google Workspace SSO, Aligned creates their account automatically as a Member of your company account. Each new user takes a seat.
Is Google Workspace SSO the same as the "Sign in with Google" button?
No, Google Workspace SAML SSO is not the same as signing in with Google. Without SSO, any Aligned user can sign in with their Google account. With Google Workspace SSO enforced, your company controls access to Aligned from the Google Admin console, and the Sign in with Google button redirects to SSO.
Can I still use my Aligned password after SSO is set up?
Once SSO is enforced, you cannot set or use an Aligned password, and you change your password in Google Workspace instead. See How Do I Change My Password?.
Where can I see who signed in to Aligned through Google Workspace?
Google Workspace SAML sign-ins are recorded in the Google Admin console under Reporting → Audit and investigation → SAML log events.