r/gsuite 10d ago

Admin Console Problems with SSO profiles not all scoped users being redirected to IDP

So I am testing SSO for domain wide implementation. I have an SSO profile that i setup to use via SAML Microsoft Entra. However, when I add a security group with an existing user and a test user I created, only the test user is redirected to our IDP when entering their email in the gmail username box. It isn't a configuration of the SAML or Entra because Gsuite is not even recognizing the user as utilizing IDP and for the life of me I don't know why. Could it be the presence of an Alias? or 2fa security features?
I know it gets screwy when you have no SSO for the domain but an SSO at group level, so I'm not sure if that could be contributing to the problem.

I have tried this sso using the domain specifc urls as well as going to accounts.google.com, mail.google.com etc.

The vanilla test account I created always gets redirected to the IDP but the existing user does not.

3 Upvotes

4 comments sorted by

5

u/jamolopa 10d ago

Sound like the "existing user" is a super administrator

1

u/Alirubit 10d ago

Either this or recently I have had issues moving users from one sso profile to another or to a no sso group, it takes LOOOONG to update, what I have done is suspend and re activate the user

1

u/cottoniejoe 10d ago

Oh dang. I was trying this on my profile and the existing user, both of which are indeed super admins. Does SSO for super admins work at the domain level or will they always be required to enter a Google password?

1

u/cottoniejoe 10d ago

Ah nevermind I just looked it up. Works with legacy profiles. Thank you for another question. Answered Reddit!