'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Restrict Google SSO Sign-In Identifiers in Microsoft Entra ID
Question details
The user needs to restrict sign-in identifiers in a Google single sign-on (SSO) integration with Microsoft Entra ID to prevent the acceptance of both user principal names and email addresses.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Configuring Google single sign-on integration with Microsoft Entra ID to tighten identity exposure.
- Observed behavior
- The current SSO integration accepts both user principal names (UPNs) and email addresses, causing security concerns regarding the unnecessary exposure of staff identifiers.
Ensure you have Global Administrator or Security Administrator privileges in your Microsoft Entra ID tenant before reviewing or modifying your enterprise SSO and identity settings.
Review Configuration and Consult Microsoft Entra ID Specialists
Since altering sign-in identifiers impacts authentication flows, it is highly recommended to have Microsoft specialists review your specific domain and application setup.
Restricting sign-in identifiers in a federated or SSO environment requires careful mapping of SAML claims. Misconfiguring these parameters can lead to tenant-wide lockouts or failed user authentications. Engaging with Microsoft Entra ID experts ensures your solution is fully supported.
Gather your current Google SSO settings, including domain configurations, SAML claims mapping, and user identifier formats in Microsoft Entra ID.
Navigate to the official Microsoft Entra ID community forums where verified Microsoft specialists and cloud identity architects provide technical guidance.
Submit a detailed question outlining your objective to restrict sign-in identifiers to either UPN or email only. Include your non-sensitive configuration data for context.
Review the customized solution provided by the specialists and carefully apply the suggested claims mapping or conditional access policies to your Entra ID tenant.
Document Your IT Policies Securely with WPS Office
While resolving complex identity configurations in Microsoft Entra ID, use WPS Office to seamlessly document your IT security policies, SSO setups, and SAML mappings. It is a lightweight, highly compatible alternative to Microsoft Office.
- 1. Install WPS Office: Download and install the free WPS Office suite on your local workstation.
- 2. Create technical documentation: Open WPS Writer to draft your Google SSO integration procedures and identity management policies.
- 3. Save in standard formats: Export your documents in universally accepted .docx or .pdf formats to easily share with your administrative team.
Frequently Asked Questions
Why does Microsoft Entra ID accept both UPN and email for Google SSO?
By default, Microsoft Entra ID attempts to match users based on standard claims provided during the SAML assertion, which often checks both the User Principal Name (UPN) and primary email address attributes to ensure a seamless authentication experience.
Can I restrict SSO sign-ins to specific external domains in Entra ID?
Yes, you can utilize cross-tenant access settings and tenant restrictions within Microsoft Entra ID to control which external domains and cloud applications your users are permitted to authenticate against.
Where can I get official support for customizing Entra ID SAML claims?
Official support is available through the Microsoft 365 admin center by opening a support ticket, or by engaging directly with cloud identity specialists on the Microsoft Q&A community forums under the Entra ID tags.
