User Support for the SCIM and SSO for Google Workspace for Internal Staff
🛠 Service Desk Guide: Google / YouTube Login Issues with Microsoft 365 MFA
Purpose
This guide helps Service Desk staff quickly identify when login failures to Google/YouTube are due to Microsoft 365 MFA problems, not SCIM provisioning or Google account issues.
How to provision Teach First users from Entra ID to Google
- Ensure the user is added to either AD-SG-Azure-SSO-Google in Active Directory, or AAD-SG-Azure-SSO-Google in Entra ID
- If you have just added the user, either wait 1 to 2 hours, or ask the Infrastructure team to manually run a sync.
- Entra ID connect syncs every 30 minutes, but the SCIM job from Entra ID to Google runs every few hours, so please give it some time
- After this is done, the user account should be created in the Google workspace in the Staff-SSO OU
🔍 How Login Works
User signs in to Google/YouTube.
Login request is redirected to Microsoft 365 (Azure AD).
Azure AD checks account status and MFA.
If MFA fails, login to Google is blocked, even though the Google account still exists.
⚠️ Common Symptoms (MFA Issue)
User: “I can’t log into YouTube.”
User: “It keeps asking me for a code I can’t provide.”
In Google Admin Console → account is active.
In Azure AD → account is enabled.
In Azure AD sign-in logs → MFA failure or conditional access denied.
✅ What SCIM Does (and Doesn’t Do)
✔ SCIM does: Create, update, suspend Google accounts when Microsoft account status changes.
✘ SCIM does not: Care about MFA problems.
➡ If Microsoft account is enabled, the Google account stays enabled.
🧭 Troubleshooting Checklist for Service Desk
Step
Where to Check
What to Do
1
Google Admin Console
Is account suspended?
Yes → SCIM issue.
No → Go to step 2.
2
Azure AD (M365 Admin)
Is account disabled?
Yes → SCIM issue.
No → Go to step 3.
3
User Feedback
Ask if they see MFA prompt / cannot complete MFA.
Yes → MFA issue.
4
Azure AD Sign-in Logs
Look for MFA error codes (e.g., 53003).
Confirms MFA issue.
🛠 How to Help the User (MFA Issues)
Guide user to re-enroll in MFA (via self-service portal if available).
If user lost their device → escalate to IT Security / Identity team to reset MFA.
❌ Do not reset or delete the Google account — the issue is with Microsoft authentication.
💡 Quick Reference
Google account suspended → SCIM (user disabled in Microsoft).
Google account active but login fails → MFA issue in Microsoft.
Fix MFA in Microsoft → restores Google access.
✍️ For Service Desk:
When in doubt, remember:
👉 If the Google account exists but login fails, it’s almost always MFA.