Set up SSO with Google
Use Google Workspace as the single source of truth for who can sign into your workspace.
SSO lets every member of your Google Workspace sign in to SEMOptimiser with their existing Google account, without you provisioning passwords. Removing them from Google Workspace immediately revokes their SEMOptimiser access too – much safer than tracking who-has-what manually.
Two flavors of Google sign-in
Don't confuse these:
- Google Sign-in (individual): any user can sign in with any Google account. Enabled by default for everyone. Doesn't enforce workspace membership.
- Google SSO (organization-wide): only Google accounts in a specific Google Workspace domain are allowed. Requires CEO plan to configure.
This article covers the second one.
Requirements
- You're on the CEO plan.
- You're a Google Workspace admin (or have someone who is).
- You have a verified domain in Google Workspace (e.g. yourcompany.com).
- You're the SEMOptimiser workspace owner.
Configure SSO
- In SEMOptimiser, go to Settings → Team → Security → Configure SSO.
- Enter your Google Workspace domain (e.g. yourcompany.com).
- Click Verify. We attempt to fetch your domain's OIDC discovery document.
- Once verified, set the default role for new SSO sign-ups (Viewer is recommended; admins promote them later).
- Optionally restrict by Google Group: only members of a specific group (e.g. [email protected]) can sign in.
- Click Enable. Existing password-based accounts are not affected; new sign-ins from yourcompany.com must use Google SSO.
How sign-in works after SSO is enabled
A user at yourcompany.com clicks "Sign in with Google" on the login page. Google authenticates them. They're bounced back to SEMOptimiser, which verifies their email domain matches the SSO config. If so, they're signed in. If their email isn't a member of your workspace yet, we provision them automatically with the default role.
SCIM provisioning
On the CEO plan, you can also enable SCIM 2.0 so adds/removes in Google Workspace flow into SEMOptimiser automatically – no need for the user to log in once to be provisioned. Settings → Team → SCIM gives you a URL and a bearer token to paste into the Google Workspace SCIM connector.
Disabling password-based sign-in
In Settings → Team → Security, toggle "Require SSO for this workspace". From then on, password login is rejected for anyone with an email matching your SSO domain. The workspace owner is exempt (so you can't lock yourself out).
Disabling SSO
Settings → Team → Security → Disable SSO. SSO-provisioned users stay in the workspace but switch back to standard Google sign-in (no domain enforcement). Their access continues uninterrupted.
One platform. Five fewer subscriptions.
Audit, index and rank –
without a fifth subscription.
Join 1,200+ agencies and in-house teams using SEMOptimiser to replace Semrush, Ahrefs, GA4 add-ons and rank trackers – with one workflow that actually ships fixes.