In short: Cisco Duo protects Google Workspace by acting as its SAML identity provider through Duo Single Sign-On. Google redirects users to Duo, which checks their password, MFA and device before sending them back. Duo can also import users from Google, provision users into Google from Duo Directory, and needs Duo Essentials or above.
How Duo protects Google Workspace
Google Workspace lets you hand sign-in to a third-party identity provider. With Duo Single Sign-On in that role, a user who opens Gmail or Drive is sent to Duo, where:
- Duo checks their primary credentials against your chosen authentication source: Active Directory, another SAML identity provider, or Duo Directory
- Duo applies the Google Workspace application's policy, looking at the user, their device and their network
- The user completes MFA in the Universal Prompt with a passkey, security key, Duo Push or Verified Duo Push, or signs in without a password using Duo Passwordless
- Duo returns them to Google, signed in
Duo SSO is included in Duo Essentials, Advantage and Premier, and the same Duo sign-in can then protect your other SAML apps, so users get one consistent login rather than a different MFA prompt for every service.
Setting it up
The outline of a typical project:
- Configure and test an authentication source in Duo SSO
- Add the Google Workspace application in the Duo Admin Panel with your Google domain
- In the Google Admin console, create a third-party SSO profile using the sign-in page URL, sign-out URL, IdP entity ID and certificate from the Duo application, then copy Google's entity ID back into Duo
- Assign the profile to a pilot organisational unit or group first. Google supports one organisation-wide profile or separate SAML profiles for different organisational units and groups
- Grant those users access in Duo, test with real devices and browsers, then widen the rollout
Assigning profiles by organisational unit is useful in schools and larger businesses: staff can move to Duo first while other groups follow later.
Caveats to plan for
- Super admins bypass third-party SSO: Google always signs super admins in on its own login page, without Duo. Protect those accounts with Google's own 2-Step Verification, ideally with passkeys or security keys
- No custom attribute or group mapping in the pre-built Google Workspace app. If you need that, Duo suggests using its generic SAML application instead
- Circular set-ups do not work: if Google is the SAML identity provider that Duo SSO uses to check passwords, Duo SSO cannot also protect that same Google account
- Session length: customising Google session duration is only available in Google Workspace Business, Education and Enterprise editions
- Legacy Duo Access Gateway reached its last day of support on 26 October 2023 for commercial Duo editions. Any old DAG-based Google set-up should move to Duo SSO
Using Google as your user directory
Many Google-first organisations have no Active Directory. Duo handles this in two directions:
| Direction | What it does | Notes |
|---|---|---|
| Google to Duo (directory sync) | Imports users and groups from Google Workspace or Cloud Identity into Duo | One-way; nothing is written back to Google. A full sync runs every 30 minutes and can be started on demand. Needs a Google admin service account to authorise it and the Duo Owner role to set up; included from Duo Essentials |
| Duo to Google (provisioning) | Creates and updates users and groups in Google from Duo Directory | Provisioned users get a random password nobody knows, so they must sign in through Duo SSO. Google groups need a generated email address |
Before the first Google sync, check for existing Duo users with the same usernames, because matching accounts can be merged with the Google data.
Device checks before Gmail and Drive
Because Duo evaluates every Google sign-in, you can decide which devices may reach your mail and files, not just which users:
- Trusted Endpoints (Essentials and above): allow only devices managed through your MDM or registered through Duo Desktop
- Device health checks (Duo Advantage and above): block or warn devices with out-of-date operating systems, no disk encryption or the firewall switched off
- Different rules for different groups: for example, staff on personal devices can read mail in a browser while admin accounts must use a trusted laptop
Read more on our device trust page.
Who it suits and how we help
Duo for Google Workspace suits Google-first businesses, charities and schools and academy trusts, particularly where staff do not all have work phones (they can use hardware tokens instead). It also helps organisations that use Google alongside Microsoft 365 or other SaaS apps and want one sign-in and one set of policies across them all.
We plan the authentication source, build the SSO profile, pilot it by organisational unit, protect super admins separately and write the user guides. Contact us to discuss Duo for your Google Workspace.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Cisco Duo work with Google Workspace?
Yes. Duo Single Sign-On acts as a SAML identity provider for Google Workspace, so users sign in through Duo with MFA and device checks before reaching Gmail, Drive and other Google apps. It needs Duo Essentials or above.
Do Google super admins use Duo SSO?
No. Google always signs super admin accounts in on its own login page, without the third-party identity provider. Protect them with Google's own 2-Step Verification, preferably with passkeys or security keys.
Can Duo sync users from Google Workspace?
Yes. Duo's Google directory sync imports users and groups from Google Workspace or Cloud Identity into Duo. It is one-way and runs a full sync every 30 minutes, with on-demand syncs available.
Can we use Duo without Active Directory for Google Workspace?
Yes. Duo Directory can hold your users in Duo itself, or you can sync users from Google. Duo Directory can also provision users into Google Workspace.
Can we roll out Duo to part of Google Workspace first?
Yes. Google lets you assign SSO profiles to specific organisational units or groups, so you can pilot Duo with one team or department before widening it.