Google Email Alias Support

When enabled, new users pushed from Okta to Google Workspace will have any additional email aliases automatically populated in Google. When performing an import from Google, newly imported users will have their email aliases pulled in from Google and set on the emailAliases property of the Google app user. If profile sourcing for Google is enabled, existing users will also get their emailAliases attribute updated when an import from Google is run.


Procedure

To enable email alias functionality with existing Google Workspace app instances you need add the emailAliases property to your app instance’s schema as follows:

  1. In Okta, go to Directory > Profile Editor.

  2. Click the Profile edit icon.

  3. Click Add Attribute.

  4. Click Refresh Attribute List.

    At this point emailAliases should be available to be added to your instance.

  5. Select emailAliases, then click Save.

  6. You now need to map the attribute to Okta User Profile (see note below). To do this go to Google Workspace attribute mapping.

Subsequent user push and import operations will now be email alias aware.

Note

If Okta is configured to Google Workspace Update User Attributes and the emailAliases Google Workspace attribute has not been mapped to an Okta attribute, Okta will replace existing Google Workspace email alias values with a blank value. Refer to About attribute mappings for more details.


Notes

  • Google enforces that the domain name of every email alias must be registered and verified within Google first. Therefore pushing an unverified domain to Google will result in an error.

  • Google enforces a maximum limit of 30 aliases.

  • For additional information see: https://developers.google.com/admin-sdk/directory/v1/guides/manage-user-aliases.

  • Okta will need to make additional API calls to fetch, create and update email aliases and these calls will count against your Google API Quotas.

  • On User Push to Google, Okta only reconciles addresses once a value has been assigned to the app user’s emailAliases property. Once a value is populated, even with an empty value, it will be pushed and overwrite Google.

  • For all users, both the username and email alias need to be unique values.