Provision Azure AD from Google Workspace

Question

When trying to set up Azure AD and Google Workspace integration it seems that all suggested setups assume that one want to use AD to administrate users. We are using Google Workspace as our source of truth, and thus for our needs what we need is for Azure AD to load from Google Workspace and not the other way around

The most useful guide I've found so far is this one: https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on however, it looks like it is still doing it the wrong way. Can this be used to use Google Workspace to load the users? Or what is the correct way?

Answer 1

That link you posted looks correct, but reading it, some of the steps seem off.

This article from Microsoft details using Google workspace as the identity provided:

https://learn.microsoft.com/en-us/education/windows/configure-aad-google-trust

"Once configured, users will be able to sign in to Azure AD with their Google Workspace credentials."

Answer 2

We've tried to setup Google Workspace and Azure AD user provisioning using the links above, but found out the configuration very unreliable. SAML/SCIM provisioning stoped working from time to time, so we had to reauthorise the "Google Cloud / G Suite Connector" app in order to make it working again. At the end we switched to https://synk.to service, which do the job using standard Microsoft Azure AD Rest API (https://learn.microsoft.com/en-us/graph/api/user-post-users?view=graph-rest-1.0&tabs=http).