Skip to main content

Onboarding

Set up ShiftControl for your Google Workspace organization in a few minutes — no setup call required.

Setting up ShiftControl on JumpCloud?

This page covers onboarding for Google Workspace organizations. If you run on JumpCloud, head over to Guided Setup (JumpCloud customers) — JumpCloud setup involves a few hands-on steps in the Google Admin console that go faster with a guide on a short call.

Overview​

Onboarding takes a few minutes. Sign up with your Google Workspace account, validate your domain, approve the permissions ShiftControl asks for, set up your departments and locations, and land on a working org with your users, groups, and admin roles already imported. No call, no waitlist, no sales gate.

What you'll need

Three things: (1) a Google Workspace account in the organization you want to manage, (2) a Google Workspace Super Admin who can approve the permissions — that can be you, or someone you send a 48-hour authorization link to, and (3) a domain that isn't already claimed by another ShiftControl organization.

How It Works​

Onboarding is a six-step wizard. Most of the work happens behind the scenes while you click through:

  1. Sign-up — Sign in with your Google Workspace account. ShiftControl creates a user record for you and links it to your Google identity. Any Workspace user can do this step.
  2. Domain validation — ShiftControl confirms that your email's domain belongs to a Google Workspace, and that no other ShiftControl organization has already claimed it. This prevents two organizations from claiming the same workspace.
  3. Authorization — A Google Workspace Super Admin grants ShiftControl permission to manage your directory. If that's you, you'll see Google's approval screen right after domain validation. If it isn't, you can send your Super Admin a 48-hour authorization link and pause here until they approve it. The Google Workspace App Authorization page has the technical detail on every permission requested.
  4. App discovery — ShiftControl scans your Google Workspace to find the SaaS apps your team is already signed in to and imports them into your ShiftControl app catalog. You see your full SaaS surface on day one without having to enumerate it.
  5. Departments and locations — set up your org's departments (Engineering, Sales, Operations…) and office locations. Each one auto-creates a ShiftControl group with a dynamic membership rule, so as users get assigned a department or location, they flow into the matching group automatically.
  6. Start your trial — provisioning completes, Google Workspace is set as your primary directory, your users and groups are imported, and you land on the Manage Users screen. You're now in the trial. Additional connectors — HRIS, app-specific integrations, anything else — are added anytime after this from Settings → Connectors.

Provisioning happens in a single transactional step — if anything fails partway, the system rolls back so you don't end up half-onboarded. Once it succeeds, completed organizations are gated from returning to the onboarding flow.

Common Scenarios​

First IT hire at a 30-person startup​

You're the new IT person at a company that started on Google Workspace. You want centralized control over users, groups, and app access this week, not next month. Onboarding takes you from sign-up to a working ShiftControl org in under ten minutes. Every existing Workspace user gets imported automatically, you create your first group, and you start cleaning up SaaS access immediately.

Founder evaluating ShiftControl before scheduling a demo​

You're a CEO who wants to see ShiftControl working with your real data before committing to a meeting. Sign up, look at your actual users and apps, and decide whether the product fits.

Replacing an old IdP​

Your company is moving off another identity provider and consolidating on Google Workspace. Onboarding gives you a clean ShiftControl org on top of Google so you can rebuild your group and app access model from scratch.

Step-by-Step Guide​

1

Go to the sign-up page

Visit app.shiftcontrol.io/signup and click Sign up with Google.

2

Sign in with your Google Workspace account

Google's sign-in screen opens. Sign in with the Google Workspace account you want to associate with your ShiftControl org. Any Workspace user can sign up at this step — you don't need to be a Super Admin yet. The Super Admin requirement applies later, at the permissions step.

3

Wait for domain validation

ShiftControl checks three things: that you signed in with a Google Workspace account (not a personal Gmail), that your email's domain is owned by your workspace, and that no existing ShiftControl org has already claimed this workspace. This usually takes a second.

See the Domain validation section below for what to do if you hit a validation error.

4

Approve permissions for ShiftControl (Super Admin required)

Google will show a screen asking you to grant ShiftControl permission to manage users, groups, and admin roles in your Workspace. This is the step that requires a Google Workspace Super Admin — other admin roles can't grant the permissions ShiftControl needs.

If you're the Super Admin, review the list and click Allow. If you aren't, send a 48-hour authorization link to a Super Admin in your organization — they can approve the connection without needing a ShiftControl account.

ShiftControl only asks for permissions it actually uses. If you want to see exactly what each one grants and why, the Google Workspace App Authorization page has the full breakdown.

5

Review discovered apps

ShiftControl scans your Google Workspace and shows you the SaaS apps your team is already signed in to. Review the list — these become your starting app catalog, and you can edit, deactivate, or assign them once you're in the product.

6

Set up departments and locations

Add your departments (Engineering, Sales, Operations…) and office locations (San Francisco, Singapore, Remote…). For each one, ShiftControl creates a group with a dynamic membership rule, so as users get assigned a department or location they flow into the matching group automatically. This is where a list of users becomes a structured org.

7

Start your trial

ShiftControl finishes provisioning — Google Workspace is set as your primary directory, your users and groups are imported, and you land on the Manage Users screen. You're now in the trial. From here, browse your users, groups, and apps, and add HRIS or other connectors from Settings → Connectors whenever you're ready. The Users and Groups sections of the docs are good next stops.

Domain Validation​

Domain validation is where most onboarding errors surface. Here's what each one means:

ErrorWhat it meansWhat to do
Not a Google Workspace accountYou signed in with a @gmail.com or other personal Google account, not a Workspace account.Sign out and sign in again with your work Google Workspace account.
Domain not eligibleThe domain on your sign-in email isn't recognized as part of a Google Workspace.Confirm you signed in with your Google Workspace account (not a personal Gmail) and that your domain is listed in Google Admin → Domains.
Domain already claimedAnother ShiftControl organization has already onboarded this workspace.Contact support — usually a teammate set up the org first. We can invite you to it.
Unsaved changesYou navigated mid-onboarding and have unsaved progress.Use the wizard back/next buttons to return to a known step. ShiftControl preserves your progress so you don't lose work.

Things to Know​

  • You can't re-enter onboarding after it completes. Once provisioning succeeds, the onboarding routes are gated for your org. This prevents accidentally re-running provisioning and clobbering your real data. If you genuinely need to restart, contact support.
  • Google Workspace is set as your primary directory automatically. When provisioning runs, ShiftControl promotes Google to primary. You don't need to configure anything in Settings → Directories afterward — it's already done.
  • Provisioning is atomic. If the Google API hits an error mid-flow, ShiftControl rolls back the partial state rather than leaving you with a half-onboarded org. Just retry.
  • You can add JumpCloud as an additional directory later. Onboarding makes Google your primary. If you ever need to connect JumpCloud too, do it from Settings → Connectors → Directories after the trial starts.
  • You don't need to be the Super Admin to start onboarding. Sign up with your own Google Workspace account. At the permissions step, send a 48-hour authorization link to your Super Admin — they can approve the connection without needing a ShiftControl account.
  • Wizard copy can shift slightly between releases. This page describes the intended flow; minor UI label changes may land between releases.