Configuring Google Workspaces SSO for Contact Center

<body>
<p id="docs-hc-snippet" style="display: none;">Both Amazon Connect and Zendesk Contact Center can be configured for SSO with Google Workspace as the SAML-based identity provider. Amazon Connect and Contact Center each require a SAML application. The required SAML applications are created and configured in the Google Workspace admin console.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="addon_contact-center">
<table>
<tbody>
<tr>
<td>
<strong>Add-on</strong>
</td>
<td>Contact Center</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Verified AI summary <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Configure Google Workspaces SSO for your contact center by setting up SAML applications in Google Workspace and AWS Cognito. This enables single sign-on, streamlining user access and enhancing security. You'll create a SAML app in Google Workspace, configure an identity provider in Cognito, and specify it for agent authentication, allowing seamless integration and management of user identities across platforms.</p>
</div>

<div class="body">

<p class="p" dir="ltr">Both Amazon Connect and Zendesk Contact Center can be configured for SSO with
Google Workspace as the SAML-based identity provider. Amazon Connect and Contact Center
each require a SAML application. The required SAML applications are created and
configured in the Google Workspace admin console.</p>
<p class="p" dir="ltr">The Google Workspaces SAML application along with an AWS IAM identity provider
will support the federation between Google and your AWS IAM users.</p>
<p class="p">This article contains the following topics:</p>
<ul class="ul" id="rjs1__ul_m5r_gxb_sgc">
<li class="li"><a class="xref" href="#topic_vrd_jxb_sgc">Configuring SSO for Amazon Connect</a></li>
<li class="li"><a class="xref" href="#topic_rjm_jxb_sgc">Configuring SSO for Contact Center</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_vrd_jxb_sgc">
<h2 class="title topictitle2" id="ariaid-title2">Configuring SSO for Amazon Connect</h2>
<div class="body">
<p class="p">You can configure Amazon Connect SSO with Google Workspaces as described in <a class="xref" href="https://catalog.workshops.aws/amazon-connect-sso/en-US/4-sso-amazonconnect-google-workspace" target="_blank">Configure Single-Sign-On for Amazon Connect Using
Google Workspace</a> in the AWS documentation.</p>
<p class="p" dir="ltr">We recommend using Service Control Policies (SCPs) to manage permissions
regarding what users and roles can do in Amazon Connect, protecting important
resources and making your system more secure. See <a class="xref" href="https://docs.aws.amazon.com/connect/latest/adminguide/security-best-practices.html" target="_blank">Security Best Practices for Amazon
Connect</a>.</p>
<p class="p" dir="ltr">The following example SCP can be used to prevent the deletion of the Amazon
Connect instance and associated role.</p>
<pre class="pre">&lt;pre&gt;&lt;code class="language-json"&gt;
&amp;lt;pre&amp;gt;&amp;lt;code class=&amp;quot;language-json&amp;quot;&amp;gt;
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AmazonConnectRoleDenyDeletion",
"Effect": "Deny",
"Action": [
"iam:DeleteRole"
],
"Resource": [
"arn:aws:iam::*:role/***Amazon Connect user role***"
]
},
{
"Sid": "AmazonConnectInstanceDenyDeletion",
"Effect": "Deny",
"Action": [
"connect:DeleteInstance"
],
"Resource": [
"***Amazon Connect instance ARN***"
]
}
]
}
&amp;lt;/pre&amp;gt;&amp;lt;/code&amp;gt;
&lt;/pre&gt;&lt;/code&gt;</pre>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_rjm_jxb_sgc">
<h2 class="title topictitle2" id="ariaid-title3">Configuring SSO for Contact Center</h2>
<div class="body">
<p class="p">Single Sign On (SSO) for Contact Center is implemented by configuring the Cognito
Userpool to use a SAML application for sign-in. The Cognito Userpool in question is
the one which was created by the Contact Center CloudFormation template.</p>
<div class="p">This section covers the following steps:<ul class="ul" id="topic_rjm_jxb_sgc__ul_f3k_v5m_tgc">
<li class="li"><a class="xref" href="#topic_j5n_srp_sgc">Gathering the required Cognito
Userpool details</a></li>
<li class="li"><a class="xref" href="#topic_dby_srp_sgc">Creating and configuring the
SAML application</a></li>
<li class="li"><a class="xref" href="#topic_v5c_trp_sgc">Configuring an identity
provider in the Cognito User pool</a></li>
<li class="li"><a class="xref" href="#topic_lph_trp_sgc">Specifying this identity
provider to be used for agent authentication</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested2" id="topic_j5n_srp_sgc">
<h3 class="title topictitle3" id="ariaid-title4">Gathering the required Cognito Userpool details</h3>
<div class="body">
<p class="p" dir="ltr">Sign in to the AWS account in which the Contact Center CloudFormation
stack was created. Navigate to the Cognito service (ensure that you are in the
correct region) and open the UserPool which was created when the Contact Center
CloudFormation stack has been created. Note down the User pool ID as per the
below image.</p>
<p class="p" dir="ltr"><img class="image" id="topic_j5n_srp_sgc__image_e1x_lsp_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_image_3.png" width="650"></p>
<p class="p" dir="ltr">Click the App Integration tab and note down the Cognito domain prefix.
This is the first part of the Cognito domain, before the '.auth.regionxxx' as
highlighted in the image below. This is also the value that was specified in the
CloudFormation template so can also be copied from the CloudFormation parameters
tab if preferred.</p>
<p class="p" dir="ltr"><img class="image" id="topic_j5n_srp_sgc__image_h3k_psp_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_image_4.png" width="600"></p>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested2" id="topic_dby_srp_sgc">
<h3 class="title topictitle3" id="ariaid-title5">Creating and configuring the SAML application</h3>
<div class="body">
<p class="p" dir="ltr">Open the Admin console in Google Workspace. In the left-most navigation
panel, select the ‘Apps’ dropdown arrow and navigate to ‘Web and mobile apps’.
Click on ‘Add app’ and select ‘Add Custom SAML app’.</p>
<p class="p" dir="ltr"><img class="image" id="topic_dby_srp_sgc__image_xyp_ssp_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_image_5.png" width="500"></p>
<p class="p"><strong class="ph b">To configure SAML integration for your Google Workspace app</strong></p>
<ol class="ol" id="topic_dby_srp_sgc__ol_awy_r3f_tgc">
<li class="li">In the App details section, enter a name for your app, an optional
description, and choose an icon.</li>
<li class="li">Click <strong class="ph b">Continue</strong>.</li>
<li class="li">Click <strong class="ph b">Download metadata</strong>. This file will be used to complete the
Cognito configuration in AWS. </li>
<li class="li">Click <strong class="ph b">Continue</strong>.</li>
<li class="li">Fill in the following fields under the Service provider details:<ul class="ul" id="topic_dby_srp_sgc__ul_ozd_hyg_pgc">
<li class="li" dir="ltr">
<strong class="ph b">ACS URL:</strong>
https://${yourDomainPrefix}.auth.{region}.amazoncognito.com/saml2/idpresponse.</li>
<li class="li" dir="ltr">
<strong class="ph b">Entity ID:
</strong>urn:amazon:cognito:sp:${yourUserPoolId}</li>
<li class="li" dir="ltr">
<strong class="ph b">NAME ID format: </strong>ENTITY</li>
<li class="li" dir="ltr">
<strong class="ph b">Name ID: </strong>Basic Information&gt; Primary email</li>
</ul>
<div class="p">
<div class="note note">
<span class="notetitle">Note:</span> Replace <strong class="ph b">${yourDomainPrefix}, ${region} </strong>and
<strong class="ph b">${yourUserPoolId}</strong> with the values from your Cognito user
pool.</div>
</div>
<p class="p" dir="ltr"><img class="image" id="topic_dby_srp_sgc__image_m2x_vsp_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_image_6.png" width="600"></p>
</li>
<li class="li">Click <strong class="ph b">Continue</strong>.</li>
<li class="li">Under Attribute mapping, add a Google Directory attribute with the following
value:
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" frame="border" id="topic_dby_srp_sgc__table_qzd_hyg_pgc" rules="all" summary="">
<colgroup>
<col>
<col>
</colgroup>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" dir="ltr" style="vertical-align:top;"><strong class="ph b">Google Directory attributes</strong></td>
<td class="entry cell-norowborder" dir="ltr" style="vertical-align:top;"><strong class="ph b">Value</strong></td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" dir="ltr" style="vertical-align:top;">Primary email</td>
<td class="entry cellrowborder" dir="ltr" style="vertical-align:top;">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</td>
</tr>
</tbody>
</table>
</div>
</li>
<li class="li">Click <strong class="ph b">Finish</strong>.</li>
</ol>
<p class="p" dir="ltr">When you create a SAML app, it is turned off by default. This means for
users logged in to their Google Workspaces account, the SAML app will not be
visible to them. Next, turn on the Contact Center app for your Google Workspace
users.</p>
<p class="p"><strong class="ph b">To grant users access to Google Workspace</strong></p>
<ol class="ol" id="topic_dby_srp_sgc__ol_zn2_3jf_tgc">
<li class="li">Navigate to User Access under the Contact Center app configuration.</li>
<li class="li"> Click <strong class="ph b">View details</strong>. </li>
<li class="li">To turn on a service for everyone in your organization, click <strong class="ph b">ON for
everyone</strong>, </li>
<li class="li">Click <strong class="ph b">Save</strong>.</li>
</ol>
<p class="p" dir="ltr"><img class="image" id="topic_dby_srp_sgc__image_e1x_zsp_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_image_7.png" width="700"></p>
<p class="p" dir="ltr">If you do not want to activate this application for all users, you can
take advantage of Google Workspaces organizational units and activate the
Contact Center app for only a subset of users.</p>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested2" id="topic_v5c_trp_sgc">
<h3 class="title topictitle3" id="ariaid-title6">Configuring an identity provider in the Cognito User pool</h3>
<div class="body">
<p class="p"><strong class="ph b">To configure an identity provider</strong></p>
<ol class="ol" id="topic_v5c_trp_sgc__ol_ah1_yyc_tgc">
<li class="li">Sign into the AWS account which contains the Cognito Userpool. Navigate to
Cognito and open the userpool.</li>
<li class="li">Select the Sign-in experience tab and then click <strong class="ph b">Add identity
provider</strong> as indicated on the image below:<p class="p" dir="ltr"><img class="image" id="topic_v5c_trp_sgc__image_v3c_dtp_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_image_8.png" width="700"></p>
</li>
<li class="li">On the resulting page, select SAML.</li>
<li class="li">Under Set up SAML federation with this user pool:<ul class="ul" id="topic_v5c_trp_sgc__ul_vzd_hyg_pgc">
<li class="li" dir="ltr">
<strong class="ph b">Provider name:</strong> Enter a name for this identity
provider. It is recommended to not use any spaces in the name e.g.
google.</li>
<li class="li" dir="ltr">
<strong class="ph b">Metadata document source:</strong> Upload the metadata file
downloaded in the Google Workspace console.</li>
</ul>
</li>
<li class="li">Under Map attributes between your SAML provider and your user pool, set the
following attribute:
<div class="tablenoborder">
<table border="1" cellpadding="4" cellspacing="0" class="table" frame="border" id="topic_v5c_trp_sgc__table_wzd_hyg_pgc" rules="all" summary="">
<colgroup>
<col>
<col>
</colgroup>
<tbody class="tbody">
<tr class="row">
<td class="entry nocellnorowborder" dir="ltr" style="vertical-align:top;"><strong class="ph b">User pool attribute</strong></td>
<td class="entry cell-norowborder" dir="ltr" style="vertical-align:top;"><strong class="ph b">SAML attribute</strong></td>
</tr>
<tr class="row">
<td class="entry row-nocellborder" dir="ltr" style="vertical-align:top;">email</td>
<td class="entry cellrowborder" dir="ltr" style="vertical-align:top;">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress</td>
</tr>
</tbody>
</table>
</div>
</li>
<li class="li">Click <strong class="ph b">Add identity provider</strong>. </li>
</ol>
<p class="p" dir="ltr">At this point the required identity provider has been created. The last
step in the Cognito configuration is to specify that the app client should use
this identity provider.</p>
</div>
</div>
<div aria-labelledby="ariaid-title7" class="topic nested2" id="topic_lph_trp_sgc">
<h3 class="title topictitle3" id="ariaid-title7">Specifying this identity provider to be used for agent authentication</h3>
<div class="body">
<p class="p">Now you need to specify the identity provided to use for agent
authentication.</p>
<p class="p"><strong class="ph b">To specify the identity provider</strong></p>
<ol class="ol" id="topic_lph_trp_sgc__ol_r3n_qzc_tgc">
<li class="li">Select App integration from the tabbed view, scroll to the bottom and click
<strong class="ph b">app-client</strong> to open it.</li>
<li class="li">Once the app-client has been opened, scroll down to the Hosted UI section,
and click <strong class="ph b">Edit</strong>.<p class="p" dir="ltr"><img class="image" id="topic_lph_trp_sgc__image_ydn_gtp_sgc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/cc_image_9.png" width="700"></p>
</li>
<li class="li">Under Hosted sign-up and sign-in pages, scroll down to the Identity
providers dropdown list. Click this and select the identity provider that
you configured in the previous step. </li>
<li class="li">Click <strong class="ph b">Save changes</strong>.</li>
<li class="li">Zendesk requires the name of the IDP (as configured under Sign-in
experience) to complete the setup of your account. Include this along with
the CloudFormation outputs information.</li>
</ol>
</div>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/9696174588954-Configuring-Google-Workspaces-SSO-for-Contact-Center",
"url": "https://support.zendesk.com/hc/en-us/articles/9696174588954-Configuring-Google-Workspaces-SSO-for-Contact-Center",
"headline": "Configuring Google Workspaces SSO for Contact Center",
"description": "You can configure Single Sign-On (SSO) for Contact Center by setting up a SAML application in Google Workspace and integrating it with the Cognito Userpool for agent authentication.",
"articleSection": "Setting up Contact Center",
"datePublished": "2025-09-09T20:18:54+00:00",
"dateModified": "2026-04-15T21:51:07.549742+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/9696174588954-Configuring-Google-Workspaces-SSO-for-Contact-Center"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>