Rippling’s GSuite integration supports a range of functionalities from Single Sign-on to API-based User & Group Provisioning. Many of the GSuite integration configurations are optional. As a company, you’re in control over the level of connectedness you would like Rippling to have to your GSuite account.
As an email provider, many applications will build off of your integration with GSuite. The accounts you distribute to your employees will often be used as the basis for their accounts within their 3rd party apps.
The Rippling GSuite integration supports the following capabilities:
- Creating Accounts
- Removing Accounts
- Managing GSuite Groups and GSuite Organizational Units
- Single Sign-On (SAML)
- Consolidated Billing
Importantly, GSuite’s Group Provisioning integration enables your Rippling group rules to immediately carry into your GSuite account and mailing lists. This provides oversight into what services your teams have access to and what teams your employees are a part of.
Managing Your GSuite Connection
How do I set up my connection with GSuite?
- To get started, sign in to your Rippling dashboard, click App Shop in the Main Menu on the left side of the page. From the App Shop, search GSuite in the search bar located in the top left of the screen. Once you’ve arrived at the GSuite application profile within Rippling’s App Shop, you can click ‘Connect Account’ to begin the installation process. Please note, you will be prompted to confirm that you are the GSuite administrator to continue with the installation. If you are not the GSuite administrator, Rippling allows you to easily invite the appropriate user to complete the installation.
- Once you’ve confirmed you’re the admin of your GSuite account, you will be asked to sign in to your GSuite organization that you would like Rippling to synchronize with. Please ensure you sign in to the email address associated with the appropriate GSuite account and that you have administrative privileges for the account.
- Once you’ve signed in to your GSuite account, you will be prompted to allow various permissions to Rippling for your account. If you’d like more information regarding these permissions, you can click the info button to the right of the capability. These capabilities enable Rippling to have various management privileges over your GSuite account that are needed for the creation and maintenance of your user accounts. These permissions do not allow Rippling the ability to read your emails nor view the files stored on your Google Drive accounts.
- Configure the provisioning rules for your company’s use of GSuite. This configuration determines which users will automatically receive GSuite user accounts when a Rippling account is created on their behalf.
- Configure the access time of your default provisioning settings for GSuite. This allows you to define when appropriate user accounts will be created and provided to your employees.
- Match your pre-existing employee accounts in GSuite with your corresponding employee accounts in Rippling. In some cases, Rippling’s matching algorithm will not be able to identify an exact match. If this occurs, you should match your pre-existing GSuite accounts with the corresponding employee accounts in Rippling.
- Add your employees, or groups of employees, to your GSuite ‘Groups’ and ‘Organizational Units’. Groups and Organizational Units can be pre-created from directly within GSuite. Please exercise caution when you are assigning individuals to these user classifications in GSuite, as any Group or Organizational Unit changes in Rippling will take place in GSuite as well. Please note, you can also manually synchronize your groups here to retrieve the latest classifications from GSuite to associate with your Rippling groups. Gsuite Groups allow you to create various teams and mailing list within GSuite. GSuite Organizational Units allows you to set specific features and settings to certain groups of users.
- Now that you’ve set up your API connection to GSuite, you will have the opportunity to set up SAML single sign-on for your employees as well. If you’d prefer to not set up SAML, you can select ‘Skip Single Sign On’. Otherwise, please follow the SAML instructions on screen in order to configure SAML for your account.
How do I disconnect my connection to GSuite?
To disconnect your GSuite account, please access your GSuite application settings as a Rippling admin. Select ‘Settings’ and navigate to ‘Manage App Accounts’. Once on this tab, select the trash icon in order to disconnect your Rippling account from your GSuite account. If using SSO, please be certain that your employees have an alternative access flow in place to connect to their GSuite services.
Getting Started with Your GSuite Account
How do I enable the access for Rippling to my company’s GSuite account?
Please be certain that API access is enabled in your GSuite account, as it will prevent Rippling from establishing a connection. This Google guide details how to control third-party app access to GSuite data.
How do I create GSuite accounts for my employees in Rippling?
Once you have connected your GSuite account to Rippling, you can assign GSuite licenses to your users automatically according to your Group Access rules and Group Access Timing. You can also manually assign GSuite licenses in the ‘Overview’ tab within the application. Please note that creating a GSuite account requires that you have available GSuite licenses for your user. If Rippling is your GSuite reseller, we will automatically create new licenses on your behalf, as needed. If GSuite is not your Reseller, you will need to ensure that you hold the appropriate quantity of licenses for your newly provisioned employees.
Users are required to have an email address in order
Please note, if GSuite is your Email provider, make sure that the access time for the GSuite App is before or at the same time as access time for any other third-party applications. This is due to many third-party applications relying on your work email address for account creation.
How do I match new employees on GSuite?
After adding new employees to Rippling, you can match them with their existing accounts in each app, including Gsuite.
- From the Rippling Dashboard, select GSuite
- Select the ‘Matches’ tab.
- Click on Accounts without a corresponding employee and choose the account you’d like to match the employee with.
- Select ‘Resolve’ and pair the corresponding employee in Rippling.
Note: Rippling may automatically match existing accounts if we’re confident they’re the same (e.g. the emails are an exact match). If you find the employee matched with his or her account in the “Employees with good matches” section instead, then you’re all set!
How do I select an employee’s GSuite email address?
As part of the onboarding process, admin can choose if they need to provide a work email to a particular employee. If they would like to provide the employee with an email address, the admin can enter the work email at that point in time or let the new hire enter the details later.
How do I change an employee’s GSuite email address?
Many third-party applications do not support API-based email changes. Due to this, changing an employee’s email address often requires that you update their accounts with the various service providers associated with the account.
You will need to suspend the previous email account from your account overview. If you’d like to delete the account entirely, you can do so from your GSuite Admin Console. This will ensure that the account no longer incurs charges. Please note, you should ensure that your accounts have been reconciled prior to deleting the gmail account.
Once you’ve suspended the previous account and added the new account, you can map the new email to your employee in the ‘Matches’ tab of your GSuite app settings.
For each third-party application that the previous email had been associated with, you’ll need to either change the email address associated with the account, or in certain cases you may have to delete the previous accounts and create new accounts. To delete or suspend, you can do so from your account overview page for each third-party application. If you do not see ‘Delete’ or ‘Suspend’, then it is likely you will need to delete the account manually from the third-party application.
Why do I need to grant permissions to Rippling for my GSuite account?
As you may have encountered in the installation flow, Rippling requires several permissions to be granted to Rippling on behalf of your GSuite account. GSuite supports the OAuth 2.0 protocol, which allows your administrator to grant limited access to Rippling with pre-defined scopes.
Rippling requires the minimal set of scopes that will allow it to appropriately manage your users and groups. This will never allow Rippling to view emails within your Gmail account or files within your Google Drive.
In order to connect your GSuite account, Rippling requires access to permissions regarding the following aspects of your account. Granting Rippling these permissions enables your team to access these functionalities through your Rippling account. These permissions are used specifically within and for your integrated application.
Managing users, viewing and managing the provisioning of domains, viewing and managing group subscriptions on your domain, viewing organization units on your domain, viewing and managing the provisioning of groups on your domain, viewing and managing the provisioning of users on your domain, managing delegated admin roles for your domain, managing your domain settings, managing data access permissions for users on your domain, managing the list of sites and domains you control.
How do I reset an employee’s password?
You can reset your employee’s password from your account overview page for the GSuite Application.
What happens if we have 2FA required in GSuite?
If your company has two factor authentication set as a requirement within GSuite, when Rippling creates GSuite accounts for your company we will automatically create and send two factor authentication backup codes, along with the temporary password, directly to the user.
How do I handle the offboarding of an employee’s GSuite account?
When offboarding an employee, Rippling allows you to control the handling of various services such as transferring the ownership of that user’s GSuite applications (e.g. Google Docs and Gmail).
- Go to Rippling and select GSuite.
- Choose, “Get Access” to their account. This should show for ‘Suspended’ users. The user should be suspended by the offboarding process. Clicking “Get Access” generates a temporary password and a backup of 2FA codes that can be used to gain access to their account.
- You have the choice to forward this information to a specified team member, such as the manager of the former employee.
How can I allow terminated employees or contractors to keep their GSuite account access?
During the termination process on the Rippling Access page, Rippling will give you the option to allow a terminated employee or contractor to keep access to their GSuite account. In order to do this, you should uncheck the GSuite app and complete the termination process as shown.
If you have already terminated the employee or contractor without following the above steps you can still grant them access. Follow these steps to do so:
- Go to the GSuite app on your Rippling dashboard>> Overview tab.
- Search for the employee or contractor>> click on the “Unsuspend” button against their name.
How do I configure the settings for temporary passwords for new accounts?
To configure temporary password settings for new accounts, please select ‘Settings’ >> ‘Temporary Passwords’ >> Edit.
How do I use ‘Email Provider Settings’?
You can select varying choices to configure your Email Provider Settings. If you decide to let Rippling automatically decide, Rippling will choose your GSuite account to create new emails for your employees, if a GSuite account is available. If you have multiple GSuite accounts, you can use this setting to specify which instance of GSuite you would like to use to generate emails. Additionally, if you would like to use a different service provider, you can select ‘No. This instance of GSuite is not used for provisioning work emails.’
How do I change my GSuite domain?
To change your GSuite primary domain, go to your Google Admin Console Dashboard > Domains > Manage Domains. From there, select your new domain name as your primary domain.
Once you’ve completed the above steps, you should update your contact details within Rippling for the new domain. To do this, please go to your Company Contact Details and update Primary Domain as the new domain. You can also add your previous domain as your secondary domain.
Lastly, you will need to disconnect your GSuite App in Rippling under Settings > Manage App Accounts > Click on Trash Icon. Once you’ve disconnected the app, you will need to connect the app again, and you can select both domains.
How can I manage multiple application accounts in GSuite?
If your organization has multiple GSuite accounts, you’re able to add additional accounts from the application’s settings page. From Settings >> Manage App Accounts >> Edit, which will allow you to add an additional account. Once you’ve added an additional GSuite account, you will be able to select which, if any, provisions employee emails from your ‘Settings’ tab.
If I’ve set up forwarding for an account, can I suspend the account and still expect the emails to be forwarded?
Suspending an account will indeed prevent all incoming emails to not be forwarded, if you don’t have routing configured. However, you can configure default routing for your company to solve this. In order to set this up, go to your Google Admin Console and search and go to ‘Default routing’.
- Put your terminated employees email address in ‘Single recipient’
- Select change envelope recipient and select ‘Replace Recipient’
- Put the email address you’d like these messages forwarded to under ‘Replace recipient’
- Click ‘Save’
You can see this Google help article to learn more about default routing and how to use it for various cases.
How do I rehire a terminated employee if that employee previously had a GSuite account that has not been deleted?
If an employee already has an active GSuite account and you want to re-assign that account to them then click on the option “Yes, let me choose their email address now” during the hiring process. Subsequently, enter the email address and the system will automatically match that account with her Rippling profile.
Please note, this works only for accounts that have not been deactivated.
Additionally, you may match the employee from the ‘Matches’ tab if the Rippling account for the employee has already been created.
How does suspending an account affect the user account?
Using the Rippling ‘Overview’ tab, your admin can suspend accounts and prevent employee access to your company’s GSuite services. Rippling does not fully delete the accounts however, and we require a company’s GSuite admin delete employee user accounts directly from the GSuite Admin Console.
If I suspend an account, will I continue paying for it?
Yes, suspended accounts are chargeable by Google. Using the Rippling ‘Overview’ tab, your admin can suspend accounts and prevent employee access to your company’s GSuite services. Rippling does not fully delete the accounts however, and we require a company’s GSuite admin delete employee user accounts directly from the GSuite Admin Console.
How do we add / remove GSuite emails for non-employees?
You will need to delete (fully, not just suspend) your GSuite users directly within your Google admin dashboard, if you have GSuite emails associated with non-employees.
You can check the list of suspended users from GSuite app in Rippling from the ‘Overview’ tab. If the employee is a contractor, you will be able to add or suspend the email from directly within your Overview dashboard, but if you need to delete the account you will need to do so from directly within your Google admin dashboard, regardless of the employee’s status.
If the user has no record within Rippling, then you will need to manage the associated account from directly within the Google Admin dashboard.
How do I see my employees’s accounts?
You are able to view your employees’s accounts and their associated statuses from the ‘Overview’ tab for the application’s settings.
How do I see my employees’s group lists?
You are able to view your employee Gsuite Groups and Organizational units from within the ‘Groups’ tab. You are able to associate various services with your Groups and Organizational Units from directly within your GSuite Admin Console.
What do the account statuses in GSuite mean?
- Waiting on signature to create account: This user will be provisioned an account once they have completed their onboarding flow in Rippling.
- No account: This user does not have a GSuite account associated with his or her Rippling account.
- Creating account (waiting on success state from app): This user is in the process of creating an account with Rippling, but he or she has not finished the creation process of the account.
- Active: This user has an active GSuite user account associated with his or her Rippling account.
- Unable to create account: For various reasons, this user could not have an account created automatically on his or her behalf.
- Suspended: This user has a suspended account, associated with his or her Rippling account. Please note, suspended accounts still incur charges in GSuite and can be deleted from your GSuite Admin Console.
How do I change my employees’s group lists?
You are able to change your employee Gsuite Groups and Organizational units from within the ‘Groups’ tab.
What are GSuite Groups? What are GSuite Organizational Units?
Administrators can turn off an organizational unit’s access to various Google services. When some users in that organization need a service, such as Gmail or Google Drive, that user can be placed with an Organizational Unit as a method of receiving access to that service.
Organizational units are used to manage the licensing of users and user access. Your GSuite Admin can create as many organizational units as they would like — in either a flat or hierarchical structure. Each sub-organization will inherit settings from its parent organization, which can be fully customized.
With GSuite Groups, you are able to create groups of users and turn on various services for each group. Group services override Organizational Units, so each member will be able to access a service, even if their organization has the service disabled.
With that in mind, users from different organizations can belong to a group, and users can belong to multiple groups. However, a user only belongs to a single organization.
What types of Groups are available in GSuite?
Public, Team, Announcement Only, Restricted, and Custom. For more information on GSuite groups, please refer to Google’s documentation.
Billing & Reseller Agreements
How do I handle charges due to GSuite?
GSuite charges are handled differently depending on whether Rippling is the reseller of your GSuite account. If Rippling is your reseller, you are able to access your GSuite-specific bills from within your Rippling invoice dashboard. You can access this information from Company Settings >> Invoices.
If Rippling is not your reseller, then you will need to pay your GSuite-specific bills from directly within your Google Admin console.
If someone wants to bypass GSuite reseller do they need to purchase the app’s package?
Yes, as you are still using the benefits of the GSuite integration, you will still need to purchase the apps package to utilize GSuite through Rippling.
Why make Rippling your GSuite Reseller?
Making Rippling your GSuite Reseller has a number of benefits.
- Rippling will automatically purchase and provision new GSuite licenses to your employees, decreasing administrative touchpoints and improving your organization’s efficiency. You will need to manage your licenses if Rippling is not your reseller.
- Gain access to Rippling Tier 1 support for GSuite-billing and account management related issues. Rippling acts as your first line of defense when it comes to any issues related to billing or account management.
- Consolidate your GSuite bill into your Rippling account for easier account management. Lower the number of stray invoices you receive every month by consolidating your bills on Rippling.
- Improve your Rippling experience by increasing our troubleshooting capabilities with access to your GSuite admin console. Ultimately, this will expedite time to resolution for any GSuite issues.
How do I set up Rippling as my GSuite reseller?
To set Rippling up as your GSuite Reseller, please follow the set up instructions as provided in the GSuite installation process. You will be prompted to ask for Rippling’s Reseller identifier and then can generate a GSuite transfer token that will allow you to transfer over the management permissions of your account to Rippling.
If you have already installed GSuite without Rippling as your GSuite Reseller, you can simply uninstall and reinstall the application to access the instructions for Rippling to become your Reseller. Alternatively, you can contact Rippling’s customer support with your transfer token, but it is recommended to simply uninstall and install the application.
What if I don’t want Rippling as my GSuite reseller?
If you would like to skip adding Rippling as your GSuite reseller, please contact firstname.lastname@example.org once you have gotten to the Reseller set-up flow during the GSuite installation process. Let our team know that you would like to skip adding Rippling as your GSuite reseller and we will process your account as an independent GSuite account. You can simply leave the instructions temporarily while you wait for our team to process this request. Once we have processed your request, you can return to the GSuite instructions and you should see the reseller step has been bypassed.
How do I manage my GSuite licenses with Rippling?
Your GSuite licenses are managed in a few different ways. First, it is dependent on whether you have enabled Rippling as the reseller for your GSuite Account.
If Rippling is your GSuite Reseller… we will be able to purchase new licenses for your organization as needed. If your account is on a commitment plan with GSuite, then you should also see a tab called ‘Licenses’ from within your application’s settings. From this tab, you’re able to increase the number of licenses, or ‘seats’, purchased for your GSuite account. If your account is on the flexible plan, then this license number will fluctuate based on the seats currently in-use. Companies on the flexible plan will not see this license tab, due to their not being a need to manually manage license counts.
Additionally, if Rippling is your reseller and your account has used all available licenses within the account for user accounts, Rippling will add a license to ensure there is a buffer of one license. This ensures that account creation does not fail when you create a new account for an onboarded employee.
If Rippling is not your GSuite Reseller… we will not be able to purchase new licenses for your organization. You will need to ensure that the appropriate number of licenses are held within your GSuite account at all times as needed by any new employees.
Rippling does not delete any GSuite accounts permanently. Offboarding an employee will suspend the user’s account, but these accounts will still incur charges. The reasoning behind this, is the accounts data will be deleted upon the permanent deletion of the account. Therefore, it is generally good practice to follow-up with your suspended accounts and delete them once you have handled the off-boarding of the account properly.
How do I upgrade or downgrade my GSuite licenses with Rippling as my reseller?
To upgrade GSuite license types, contact email@example.com directly to upgrade. By default new accounts are based on the existing terms of your plan with Google. Our support team can upgrade your account license types as needed.
Where can I find pricing and commitment information for GSuite?
Pricing and commitment information can be found at https://support.google.com/a/answer/1247360?hl=en.
What type of integration does Rippling have with GSuite?
Rippling integrates with GSuite over APIs and SAML-based Single Sign-on.
What fields are pushed from Rippling during user creation?
Currently, Rippling pushes the following attributes to GSuite upon account creation:
- First Name
- Last Name
- Company Name
- Job Title
- Phone Number
- Work location
Rippling can add or modify specific fields for your company as needed, with new data management capabilities currently in-development.
How often does Rippling sync data with GSuite?
Every 24 hours, unless a company admin, selects ‘Sync’. Your Rippling admin can view when the last sync took place or select ‘Sync’, by going to the GSuite App Settings >> Settings >> Sync. Information regarding the last sync is provided under the ‘Last pulled’ field. Typically, automatic sync take place daily around 1:30am pst.