Skip to main content
Set up a custom SAML app in Google Workspace to let your team sign in to Modus using their Google identities. This guide walks through the Google (identity provider) side of the configuration.

​
Prerequisites

Before you begin, make sure you have:
  • A Google Workspace admin account with the privilege to manage apps. A super admin works, or a custom admin role that includes the SSO / apps privilege.
  • The service provider details from the app you’re connecting (its ACS URL, Entity ID, and the attribute names it expects). These are app-specific — for Modus, you’ll find them on your SSO settings page.

​
Google Workspace Setup

1

Open the custom SAML app setup

  1. Go to the Google Admin console.
  2. Navigate to Apps → Web and mobile apps.
  3. Click Add app → Add custom SAML app.
2

Enter the app details

Give the app a name (for example, Modus) and optionally upload an icon. Click Continue.
3

Grab Google's IdP details

This screen shows what Google (the identity provider) supplies to your app:The simplest option is Download Metadata — that single XML file bundles the SSO URL, Entity ID, and certificate together. If your app accepts a metadata file or URL, use that and skip copying the three values by hand.Click Continue.
Uploading the metadata file avoids transcription errors with the certificate and Entity ID, which are the most common source of failed SSO setups.
4

Enter the service provider details

Now enter the values the app provided:Click Continue.
The Entity ID and ACS URL must match the app’s expected values exactly — trailing slashes matter. A mismatch is the most common reason logins fail.
5

Map attributes

Map Google directory fields to the attribute names the app expects. The app’s docs list the exact names. Common mappings:If the app uses group-based roles, add a Group membership mapping as well and select which groups to send.Click Finish.
6

Turn the app ON

This is the step people most often miss.
  1. On the app’s page, click User access.
  2. Set the service status to ON for everyone (or ON for specific organizational units / groups).
  3. Click Save.
7

Wait and test

Changes can take a few minutes — and occasionally up to ~24 hours — to propagate, though it’s usually fast.
  1. Test IdP-initiated login first if available, from the user’s Google app launcher.
  2. Then test SP-initiated login by signing in from the app itself.

​
Common gotchas

  • Entity ID and ACS URL must match exactly. Trailing slashes and http vs. https matter — copy them character-for-character from the app.
  • Name ID format mismatch. If the Name ID format doesn’t match what the app keys users on, logins will succeed at Google but the app may reject the user or create a duplicate account.
The ACS URL, Entity ID, and attribute names are app-specific. For Modus, copy these values from your SSO settings page and plug them into the Service provider details and Attribute mapping steps above. Reach out to support@getmodus.com if you need them.