Google SSO
Connect Google SSO to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Google SSO to collect identity & sso evidence automatically.
| Category | Identity & SSO |
| Connect with | OAuth, API token |
| What a connection produces | Automated evidence collection |
Connect with OAuth
Before you start, an administrator of Google SSO must allow third-party apps:
- If your Admin console restricts unconfigured apps: go to Menu › Security › Access and data control › API controls and click Manage App Access.
- Click Configure new app, enter Safeguard's app name or OAuth client ID and click Search, then select it.
- Choose the organizational units it applies to (or leave the default for all users), select Trusted, and click Continue, then Finish.
- By default Allow users to access any third-party apps is set, so no step is needed unless you changed the Unconfigured third-party apps setting.
- On Compliance › Connectors, open Google SSO, click Connect and choose OAuth.
- Sign in to Google SSO and approve Safeguard on its consent screen. Use an account that can approve apps for your organization, usually an administrator. Safeguard asks for
https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly,https://www.googleapis.com/auth/admin.directory.device.mobile.readonly. - You return to Safeguard, and the card shows Verified once the first check succeeds.
Connect with an API token
-
In Google SSO, create the credential for API token / Personal access token, read-only where it offers that.
-
On Compliance › Connectors, open Google SSO, click Connect, choose API token and fill in:
Field What to enter API token / Personal access token Required. Stored encrypted and never shown again. Base URL (optional) — Account / Org / Workspace (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Google SSO and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | C1.1, CC6.1, CC6.2, CC6.3, CC6.5, CC6.6, CC6.7, CC6.8, CC7.1, CC7.2, CC9.2 | 28 |
| ISO/IEC 27001 | Automated tests | A.5.9, A.5.11, A.5.14, A.5.16, A.5.17, A.5.18, A.5.19, A.6.5, A.8.1, A.8.2, A.8.3, A.8.5, A.8.7, A.8.8, A.8.9, A.8.12, A.8.16, A.8.20, A.8.24 | 28 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1), 164.308(a)(3), 164.308(a)(4), 164.308(a)(5), 164.308(b)(1), 164.310(d)(1), 164.312(a)(1), 164.312(d), 164.312(e)(1) | 24 |
| PCI DSS | Automated tests | 1.5.1, 3.5.1, 5.2.1, 5.4.1, 6.3.3, 7.2.1, 7.2.2, 7.2.4, 8.2.5, 8.2.6, 8.2.8, 8.3.4, 8.3.6, 8.4.1, 8.4.2, 10.4.1, 12.5.1 | 22 |
| NIST CSF 2.0 | Automated tests | DE.CM-03, DE.CM-09, GV.SC-04, GV.SC-05, ID.AM-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.DS-01, PR.DS-02, PR.IR-01, PR.PS-02 | 24 |
These tests are switched on per workspace by the Safeguard team.
Google Cloud Identity, Google Workspace connect to the same provider as Google SSO, and these tests run for a connection made through any of them.
Related
- Identity & SSO connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks