Use federated authentication with Google Workspace in Apple School Manager
In Apple School Manager, you can link to Google Workspace using federated authentication to allow users to sign in to Apple devices with their Google Workspace user name names (generally their email address) and password.
As a result, your users can leverage their Google Workspace credentials as Managed Apple Accounts. They can then use those credentials to sign in to their assigned iPhone, iPad or Mac, and even to iCloud on the web.
Google Workspace is the identity provider (IdP) that authenticates the user for Apple School Manager and issues authentication tokens. This authentication supports certificate authentication and two-factor authentication (2FA).
Before you begin
Before you link to Google Workspace, consider the following:
You must lock and turn on domain capture before you can federate. See Lock a domain.
Federated authentication should use the user’s email address as their user name. Aliases are not supported.
For existing users with an email address in the federated domain, their Managed Apple Account is automatically changed to match that email address.
Disconnect from your Student Information System (SIS) or stop uploads using SFTP.
User accounts with the role of Administrator, Site Manager or People Manager cannot sign in using federated authentication; they can only manage the federation process.
When the Google Workspace connection has expired, federation and syncing user accounts with Google Workspace stops. You must reconnect to Google Workspace to continue using federation and syncing.
Federated authentication process
This process involves three main steps:
Configure federated authentication.
Test federated authentication with a single Google Workspace user account.
Turn on federated authentication.
If you are attempting to federate a domain you have already verified but another organisation has already federated the identical domain, you must contact that organisation to determine who has the authority to federate the domain. See Domain conflicts.
Step 1: Configure federated authentication
The first step is to establish a trust relationship between Google Workspace and Apple School Manager.
Note: After you complete this step, users cannot create new personal Apple Accounts on the domain you configure. This could affect other Apple services your users access. See Transfer Apple services when federating.
In Apple School Manager
, sign in with a user that has the role of Administrator, Site Manager or People Manager.Select your name at the bottom of the sidebar, select Preferences
, select Managed Apple Accounts 
, then select Get Started under “User sign in and directory sync”.Select Google Workspace, then select Continue.
Select “Sign in with Google”, enter your Google Workspace administrator user name, then select Next.
Enter the password for the account, then select Next.
If necessary, review the list of automatically verified domains and any conflicting domains.
Carefully read the agreement, then accept the Terms and Conditions, then check the following:
View audit reports for your Google Workspace domain
View domains related to your customers
See info about user accounts on your domain.
Select Continue, then select Done.
In some cases you may not be able to sign in to your domain. Here are some common reasons:
The Google Workspace administrator account used does not have permission to add domains.
The username or password from the account in steps 4 or 5 are incorrect.
You or another Google Workspace administrator modified the default attributes.
Step 2: Test federated authentication with a single Google Workspace user account
Important: The federated authentication test also changes your default Managed Apple Account format. New accounts created in your Student Information System (SIS) or uploaded using Secure File Transfer Protocol (SFTP) use the new Managed Apple Account format.
You can test the federated authentication connection after you have performed the following tasks:
The check for username conflicts is complete.
The Managed Apple Account default format is updated.
After you successfully link Apple School Manager to Google Workspace, you can change the role of a user account to another role. For example, you may want to change the role of a user account to a Staff role.
In Apple School Manager
, sign in as a user that does not have a Staff or Student role.If the username you signed in with is found, a new screen indicates that you are signing in with an account in your domain.
Select Continue, enter the password for the user, then select Sign In.
Sign out of Apple School Manager.
Note: Users cannot sign in to iCloud.com unless they first sign in with their Managed Apple Account on another Apple device.
In some cases you may not be able to sign in to your domain. Here are some common reasons:
The username or password from the domain that you chose to federate is incorrect.
The account is not in the domain that you chose to federate.
Step 3: Turn on federated authentication
If you are planning to sync Google Workspace with Apple School Manager, you must turn on federated authentication before you sync.
In Apple School Manager
, sign in with a user that has the role of Administrator, Site Manager or People Manager.Select your name at the bottom of the sidebar, select Preferences
, then select Managed Apple Accounts .In the Domains section, select Manage next to the domain you want to federate, then select “Turn on Sign in with Google Workspace”.
Turn on “Sign in with Google Workspace”.
If necessary, you can now sync user accounts to Apple School Manager. See Sync user accounts from Google Workspace.