Home Administration Secure Access Single Sign-on: Google Workspace

Table of Contents

Was this article helpful?

Yes No

Thank you for your feedback!

Single Sign-on: Google Workspace

In this article you'll learn:

  • Complete steps for setting up Google apps single sign-on for Heap
This doc is for: Admins

Overview

This feature is only available to customers on Pro and Premier plans. To upgrade, contact your Customer Success Manager or sales@heap.io

Security Best Practice

If you use SSO, we strongly recommend that you set up mandatory 2FA for all Heap admins.

To learn more, see enabling mandatory 2FA for your Heap domain.

Integrating Heap with Google Workspace SSO enables your team to sign in to Heap with their Google account without needing a second sign-in. This has the benefit of requiring one less password to manage and allows you to take advantage of all of the account security features Google provides.

Prerequisites

To set up Google Workspace SSO with Heap, you’ll need to have the following:

  • Admin access to your organization’s Heap account
  • Administrator rights in your organization’s Google Workspace account

Setup

Note that once SSO is enabled, it will be enforced as mandatory for all non-Admins in your Heap workspace.

To set up SSO for Google Workspace, complete the steps below:

  1. Sign in to admin.google.com
  2. Go to Apps
  3. Go to SAML Apps
  4. Click add (plus, bottom right)
  5. Select Setup my own custom app
  6. Copy the SSO URL into the Heap login URL field
  7. Download the cert from Google
  8. Copy the contents of the downloaded cert into the Heap cert field
  9. Configure the provider in Heap
  10. In Google, click next, then name the app
  11. The next page in Google requires the following Heap settings:
  12. ACS URL: https://heapanalytics.com/saml/finalize/YOUR_APP_ID/ <– replace YOUR_APP_ID with the ID associated with your app
  13. EntityID: heapanalytics.com
  14. Back in Heap, click Test provider
  15. You’ll be redirected to Google and then back to Heap – it should be successful, in which case you can enable the provider
  16. Add your teammates at heap.io, and have them log in with just their email address

Documentation

We also recommend reviewing Google’s documentation on setting up your own custom SAML application.