What you will set up

• Single Sign‑On (SSO) from Google Workspace to Popl using SAML 2.0.

• Automated user lifecycle options that actually work with Google Workspace today: (a) Popl’s native Google Workspace directory sync, or (b) SCIM provisioning through an IdP bridge (Okta/Entra) to Popl.

• Secure, least‑privilege scopes and recommended attribute/field mappings.

Key reality (October 13, 2025): Google Workspace does not offer a generic, standards‑based SCIM push for arbitrary apps. Google automated provisioning only works for apps on Google’s supported list. To provision users into Popl directly with SCIM, use an IdP bridge (e.g., Okta, Entra) or Popl’s native Google Directory sync. See Google’s “About automated user provisioning” and supported-apps guidance. Google Admin Help.

Architecture options (choose one)

1) Google Workspace SAML SSO + Popl native Google Directory sync (recommended for Google‑only shops)

• Authentication: Google Workspace SAML → Popl.

• Provisioning: Popl reads users/groups from Google Directory via Admin SDK scopes you approve.

• References: Popl Integrations • Popl Enterprise.

2) Google Workspace as IdP → Okta/Entra as SCIM bridge → Popl (recommended if you already run a workforce IdP)

• Authentication: Google SAML to Okta/Entra (or vice‑versa per your pattern), then SAML/OIDC to Popl.

• Provisioning: Okta/Entra pushes users/groups to Popl over SCIM.

• References: Popl SCIM provisioning.

3) SAML SSO only (manual/CSV add in Popl)

• Use when you can’t grant directory scopes or don’t have an IdP bridge. You can still centralize auth and add members in Popl via bulk methods.

Prerequisites

• Google: Super Admin role (or a custom role with Web & mobile apps > Manage SAML apps, and User access management). Examples: Airtable’s guide clarifies the needed SAML permissions in Google. Airtable support.

• Popl: Popl Teams Admin access.

• Security & compliance: Popl is SOC 2 Type 2 and GDPR‑aligned; see Popl DPA and SOC 2 note.

Part A — Configure Google Workspace SAML SSO to Popl

This uses Google’s “custom SAML app” flow. (Google’s UI wording may differ slightly across releases.)

1) In Google Admin

• Go to Admin console → Apps → Web & mobile apps → Add app → Add custom SAML app. Guides with screenshots: Robin, SmartDraw, Productive. Example 2 • Example 3.

• App name: “Popl SSO” (optional icon: Popl logo).

• On “Google Identity Provider details”, download IdP metadata XML (or copy SSO URL, Entity ID, and download Certificate) for Popl.

2) In Popl (Service Provider settings)

• In the Popl Teams admin, open SSO/SAML settings (or contact teams@popl.co) and upload your Google IdP metadata (or paste SSO URL, Entity ID, certificate). Popl supports SAML 2.0 for SSO. References: Popl Enterprise, Popl Integrations.

3) Back in Google Admin — Service Provider details

• Paste Popl’s ACS URL and Entity ID (available in Popl SSO settings). Set NameID format = Email (Primary email).

• Attribute mapping (optional but recommended):

• First name → givenName

• Last name → familyName

• Job title → title

4) Assign and test

• Turn on the SAML app for a test OU or Access Group (Admin console → Apps → Web & mobile apps → your app → User access → On for selected users/groups).

• Test SP‑initiated sign‑in (from Popl) and IdP‑initiated launch (from Google app launcher). Use Google SAML audit logs if needed.

Screenshot cues

• “Add custom SAML app” wizard → IdP details page shows SSO URL / Entity ID / certificate.

• Popl SSO page expects IdP metadata (or individual values) and exposes ACS URL / Entity ID to paste back into Google.

Part B — Automate provisioning

Because Google does not provide generic SCIM push to arbitrary apps, you have two proven routes to keep Popl membership in sync.

Option 1: Popl native Google Workspace directory sync (no extra IdP required)

• What it does: Popl reads users (and optionally groups) from Google Directory, keeping Popl membership updated for onboarding/offboarding. See Popl Integrations and Popl Enterprise.

• How it connects: OAuth to Google Admin SDK Directory API with least‑privilege scopes (read‑only unless you want writes). Google’s scope list: Directory API scopes.

• Typical minimum scopes (read‑only):

• Users: https://www.googleapis.com/auth/admin.directory.user.readonly

• Groups (if you sync group membership): https://www.googleapis.com/auth/admin.directory.group.readonly

• (Optional) Organizational Units: https://www.googleapis.com/auth/admin.directory.orgunit.readonly

• Why least privilege: Aligns with Google’s guidance to request the narrowest scopes needed. Google Developers.

• Enablement steps (high‑level): 1) In Popl Teams admin, open Integrations → Google Workspace (or contact teams@popl.co to enable the connector). 2) Authorize Popl via Google OAuth consent using a super admin (or a delegated service account you control). 3) Choose sync sources (OUs and/or Groups), cadence, and conflict rules (e.g., do not overwrite user‑edited fields in Popl). 4) Run an initial dry‑run, review the member diff, then activate sync.

Option 2: SCIM provisioning via an IdP bridge (Okta/Entra) to Popl

• Use Okta or Microsoft Entra ID to push users/groups into Popl through SCIM. This is the most direct standards‑based push supported by Popl today.

• Popl SCIM endpoint & token: in Popl SCIM provisioning • Base URL: https://api.popl.co/api/external/scim/ • Token from Popl Support.

• Okta configuration (from Popl docs): enable SCIM, set Unique identifier = userName, enable Push New Users / Profile Updates / Push Groups, Auth mode = HTTP Header with Popl token. Popl SCIM provisioning.

• Entra (Microsoft) configuration: Automatic provisioning with Tenant URL + Secret Token; current Popl SCIM supports name & email for Users; groups unsupported at time of writing. Popl SCIM provisioning.

• Why a bridge is needed: Google’s generic SCIM push is not available for arbitrary apps; automated provisioning works only for apps on Google’s supported list. Google Admin Help. Many vendors highlight the same limitation publicly.

Recommended attribute & field mappings

These mappings avoid brittle, app‑specific fields and keep Popl cards consistent for branding and analytics.

For SAML SSO (Google → Popl)

Notes

• NameID=email keeps identity linking simple and aligns to Popl CRM sync assumptions.

• You can omit optional attributes initially and add them later with no downtime.

For SCIM (IdP bridge → Popl)

• userName → Email (unique ID)

• name.givenName / name.familyName → First/Last Name

• title → Job Title

• urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.department → Department

• Optional: phoneNumbers[type=work], photos[type=photo]

• Okta: enable Push New Users, Push Profile Updates, Push Groups (Popl supports groups via Okta; not via Entra at time of writing). Popl SCIM provisioning.

Testing and rollout checklist

• SSO: validate IdP‑ and SP‑initiated flows; verify NameID=email in assertions.

• Access scoping: assign the SAML app to a pilot group first; expand by OU or Access Group.

• Provisioning: run a read‑only preview (or test tenant) before enabling writes; verify field mappings and ownership rules.

• CRM sync: once members exist in Popl, confirm your CRM mappings still route owners and tags correctly. See Popl CRM Integrations.

• Security review: confirm Popl’s SOC 2/GDPR posture and your approved Google scopes. Popl DPA • Directory API scopes.

FAQs

• Does Google Workspace support SCIM directly to Popl?

• Not generically. Google’s automated provisioning works only for apps on its supported list. For Popl, use Popl’s Google Directory sync or an IdP bridge (Okta/Entra) that pushes SCIM to Popl. Google Admin Help • Popl SCIM provisioning.

• What scopes should I allow if we use Popl’s native Google sync?

• Start with read‑only scopes for Users, Groups, and (optionally) OUs. See Google’s official Directory API scopes list and choose the minimal set. Directory API scopes.

• Can we provision on first SSO login (JIT)?

• If you need guaranteed, policy‑driven lifecycle (suspend/terminate), prefer Directory sync or SCIM via IdP. Popl supports bulk/CSV add for one‑time loads; for ongoing changes, automate via Option 1 or 2 above. See Popl Integrations.

Cross‑links

• Platform: Popl Enterprise • Popl Integrations • CRM Integrations • DPA/Security

• Identity: Popl SCIM provisioning

• Google reference (how Google SAML apps are added and why generic SCIM isn’t available): Google Admin Help • Example SAML setup guides with screenshots 2 3.

Success criteria (what “good” looks like)

• All targeted users can launch Popl from Google’s app launcher and access with SSO; no local Popl passwords.

• New hires appear in Popl within minutes/hours (per chosen sync), with correct name/title/department and card template.

• Departed users are deactivated automatically in Popl.

• CRM ownership, event ROI tagging, and lead capture work unchanged after SSO cutover.

If you want a guided setup (including change management and pilot planning), ask your Popl CSM or email teams@popl.co.