Can we restrict 3rd party SSO for certain OU's?

jake-story · 08-22-2022 12:33 PM

I have an Organizational Unit that contains our (restricted) contractor accounts. We also have many systems such as Slack and Jira which are configured to be "open to a domain", meaning you can SSO using your Google Account to create a user in the service. I would like to restrict the contractor accounts from getting access to certain "3rd party" services like Slack and Jira.

It seems this would be possible across the org by restricting 3rd party APIs entirely, and then setting up allowlists "Trusted" instead of "Blocked" or "Limited" on this page https://admin.google.com/ac/owl/list?tab=apps, but it seems impossible to do so for a specific Organizational Unit.

Am I reading something wrong or is there a workaround for this?

Thanks!

anel

You can use SSO profiles to apply them to an OU. Only users within that Ou would be using SSO. https://support.google.com/a/answer/12032922?hl=en