Skip to content

Menu

Log inBook a demo

Identity

Finly + Google Workspace

Identity · Two-way sync · Live since 2024 · About 10 minutes to connect

Connect Google WorkspaceRead the setup guide

What it does

Finly signs people in through Google Workspace and takes its roles from the groups you already run. Organisational units come across as cost centres, so the directory you keep for email keeps the cards too.

What syncs

What moves, and which way.

Both directions, on every sync.Nothing here is a nightly batch —a record that changes at 14:02 is in the ledger before you look at it.

Google Workspace → Finly

  • Users, through SCIM 2.0
  • Group membership, mapped to Finly roles
  • Organisational units, as cost centres
  • Custom schemas used for entity and location
  • Suspension and deletion, applied at once
  • Two-step verification status at sign-in

Finly → Google Workspace

  • Sign-in and session events, back to the log
  • Role changes made inside Finly
  • Card freeze status on a suspended user

Connected

What it looks like once it is on.

The Finly ledger view for a connected payments account: €1.84M settled this month, €41,900 of processing fees at 2.3% of gross, no unreconciled payouts, a twelve-week payout chart split between cards, gross and reimbursements, and three lines needing a human.

One login, one leaver process.

Everyone signs in through Google Workspace and lands on the role their group says they should have.Deprovision there and the Finly session ends the same minute, with the cards frozen behind it.

See the ledger view

Before you start

What you need, and what it will not do.

You need a Google Workspace tenant with rights to add an application, and a Finly plan on Scale or above —SSO is not on Core.Finly is a SAML 2.0 service provider with SCIM 2.0 for provisioning, so setup is the metadata exchange you have done before:upload ours, paste yours, map three attributes, test with one user.

Two things it deliberately will not do.It will not lock you out —break-glass password access stays on for the owner account until you switch it off yourself, and it can be restored from the recovery flow.And it will not grant spend:Google Workspace decides who gets in and which role they land on, while card limits and approval rights stay in Finly, where finance owns them.

Related

All 60 integrations

Others in identity.

Okta

SAML sign-in with SCIM provisioning.

OneLogin

One directory, one set of card rights.

JumpCloud

Device-aware sign-in for smaller teams.

Get started

Stop closing the month in arrears.

Book a 30-minute demo and we'll run your own last month through a sandbox, so you can see the close before you commit to anything.

Book a demoTalk to sales