Customer Google Sign-In Marketplace Portal Copy Pack
Customer Google Sign-In Marketplace Portal Copy Pack
1. Purpose
Provide customer-friendly field copy for marketplace forms used to onboard Google sign-in through Microsoft Entra External ID.
This copy is designed for direct use in a portal form builder with clear labels, short help text, and validation notes.
2. Form introduction text
Use this as the form header description:
Provide the details below so Synkronyx can onboard Google sign-in safely and complete pilot validation before deployment. All required fields must be completed before scheduling.
3. Field copy by section
3.1 Organization profile
| Field label | Required | Help text | Validation | Example |
|---|---|---|---|---|
| Legal organization name | Yes | Enter the full registered legal name of your organization. | 2 to 120 characters. | Contoso Manufacturing Ltd |
| Primary business domain | Yes | Enter the domain used by your workforce identities. | Valid domain format. | contoso.com |
| Primary deployment region | Yes | Enter the preferred primary hosting region for your deployment. | Free text or controlled list. | UK South |
| Technical owner email | Yes | Enter the email for the person who will support configuration and validation tasks. | Valid email format. | - |
| Security owner email | Yes | Enter the email for the approver responsible for identity and access decisions. | Valid email format. | - |
3.2 Google identity profile
| Field label | Required | Help text | Validation | Example |
|---|---|---|---|---|
| Google tenant type | Yes | Select your tenant type. | Must be one of Cloud Identity Premium or Google Workspace. | Cloud Identity Premium |
| Verified Google domain | Yes | Enter the verified domain used in Google Admin. | Valid domain format. | contoso.com |
| Google super admin email | Yes | Enter the account used for Google identity configuration sessions. | Valid email format. | google-admin at contoso dot com |
| Google break-glass admin email | Yes | Enter the emergency admin account that remains available if SSO is disabled. | Valid email format. | google-breakglass at contoso dot com |
| Break-glass test confirmation | Yes | Confirm that local sign-in for break-glass account is tested and working. | Boolean checkbox. | true |
3.3 Google federation credentials
| Field label | Required | Help text | Validation | Example |
|---|---|---|---|---|
| Google OAuth project ID | Yes | Enter the Google Cloud project ID that contains the OAuth client used for Entra federation. | 6 to 63 characters, lowercase letters, numbers, and hyphens. | contoso-identity-prod |
| Google OAuth Client ID | Yes | Enter the OAuth Client ID for the web application used with Entra. | Non-empty string. | - |
| Google OAuth Client Secret reference | Yes | Provide a secure reference to the secret location. Do not paste raw secret value in this form. | Non-empty string. | keyvault://kv-customer-identity/secrets/google-oauth-client-secret |
| OAuth consent support email | Yes | Enter the support email configured on the Google OAuth consent screen. | Valid email format. | id-admin at contoso dot com |
3.4 Entra context
| Field label | Required | Help text | Validation | Example |
|---|---|---|---|---|
| Entra tenant ID | Yes | Enter the tenant ID where ERO External ID configuration will be applied. | GUID format. | 11111111-2222-3333-4444-555555555555 |
| Entra tenant domain | Yes | Enter the primary Entra tenant domain. | Domain format. | contosoexternal.onmicrosoft.com |
| Target user flow name | Yes | Enter the user flow that will be used for Google pilot sign-in. | Non-empty string. | B2C_1_SUSI_ERO_DEV |
| Approve Google provider in user flow | Yes | Confirm approval to enable Google identity provider for the specified user flow. | Boolean checkbox. | true |
3.5 Pilot scope
| Field label | Required | Help text | Validation | Example |
|---|---|---|---|---|
| Pilot user email | Yes | Enter the first pilot account for sign-in validation. | Valid email format. | pilot-user at contoso dot com |
| Pilot group name | Yes | Enter the group name used to constrain pilot access. | Non-empty string. | grp-contoso-google-sso-pilot-users |
| Pilot start window UTC | Yes | Enter the planned start date and time in UTC. | ISO 8601 datetime. | 2026-08-10T09:00:00Z |
| Pilot end window UTC | Yes | Enter the planned end date and time in UTC. | ISO 8601 datetime. | 2026-08-10T11:00:00Z |
| Local fallback enabled during pilot | Yes | Confirm local fallback sign-in remains enabled during pilot execution. | Boolean checkbox. | true |
3.6 Governance approvals
| Field label | Required | Help text | Validation | Example |
|---|---|---|---|---|
| Identity change approver | Yes | Enter the name and email of the approver for identity changes. | Non-empty string. | Sarah Patel, sarah-patel at contoso dot com |
| Rollback approver | Yes | Enter the name and email of the approver who can authorize rollback. | Non-empty string. | David Lee, david-lee at contoso dot com |
| Approved change window UTC | Yes | Enter the approved implementation window in UTC. | Time range format or two datetime fields. | 2026-08-10T09:00:00Z to 2026-08-10T11:00:00Z |
3.7 Optional automation onboarding
| Field label | Required | Help text | Validation | Example |
|---|---|---|---|---|
| Automation requested | No | Select true if you want automated Entra-to-Google group synchronization after pilot acceptance. | Boolean checkbox. | false |
| Delegated admin email for automation | No | Enter the delegated admin account used by automation for Google Admin SDK operations. | Valid email format. | automation-admin at contoso dot com |
| Service account identifier | No | Enter the service account identifier used for Google automation. | Non-empty when Automation requested is true. | service-account-id-placeholder |
| Approved Admin SDK scopes | No | Enter the approved scopes used by automation. | Array of scope strings. | [“https://www.googleapis.com/auth/admin.directory.group”] |
| Automation secret reference | No | Provide the secure location reference for automation credentials. | Non-empty when Automation requested is true. | keyvault://kv-customer-identity/secrets/google-adminsdk-credential |
4. Portal validation rules
Use these implementation rules in the marketplace form:
- If Automation requested is true, all optional automation fields become required.
- If Google tenant type is missing, block submission.
- If OAuth secret field appears to contain a raw secret value, block submission and instruct customer to provide a secret reference.
- If pilot dates are invalid or end is earlier than start, block submission.
5. Customer confirmation text
Use this confirmation checkbox label:
I confirm that the information provided is accurate and that listed approvers are authorized to approve identity changes and rollback actions.
6. Internal handoff note
After submission, route the record to:
- Synkronyx delivery lead for technical completeness review.
- Synkronyx security reviewer for approval-gate validation.
- Implementation scheduling queue when both reviews are complete.