UPES: Google Workspace & Microsoft 365 hybrid integration

Overview

Executive summary

UPES (University of Petroleum and Energy Studies) needed a robust integration between Google Workspace for Education and Microsoft 365 (Entra ID) to unify digital workspaces for thousands of students, faculty and administrative staff. As the official Google Workspace Education partner, Core5 led the architecture and deployment — enabling centralized single sign-on (SSO), automated identity lifecycle provisioning and dual-cloud mail routing using secondary domains, without disrupting daily academic operations.

The challenge

What they were up against

• Dual identity management: provisioning accounts across both platforms manually led to directory drift and stale accounts.
• Fragmented user experience: separate credentials for Microsoft 365 (Teams, Office apps) and Google Workspace (Drive, Docs, Gmail).
• Domain ownership and mail coexistence across primary and secondary subdomains without SPF/DKIM failures or mail loops.
• A need for granular, role-based security — different access rules for students versus faculty and staff.

Our solution

How Core5 approached it

• Phase 1 — Secondary domain & DNS routing: registered and verified secondary subdomains in both the Google Workspace Admin Console and Microsoft 365 Admin Center using public DNS TXT records.
• Configured MX records to route mail primarily through Google Workspace with fallback relay to Exchange Online, plus a unified SPF record authorizing both Google and Microsoft 365 (v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all).
• Published separate 2048-bit DKIM keys and DMARC records on both consoles to maintain domain trust and prevent spoofing.
• Phase 2 — Single sign-on via SAML 2.0: set Microsoft Entra ID as the Identity Provider and Google Workspace as the Service Provider using the pre-integrated Entra ID gallery app.
• Configured SAML endpoints (ACS URL https://www.google.com/a/upes.ac.in/acs, EmailAddress Name ID mapped to userPrincipalName), uploaded Entra ID's signing certificate into Google Workspace, and applied targeted SSO profiles per OU with local break-glass admin accounts.
• Phase 3 — Automated provisioning & OU mapping: enabled Entra ID SCIM provisioning to sync directory objects to the Google Workspace Directory API.
• Mapped attributes (userPrincipalName to primaryEmail, givenName/surname to name, department to organization) and used dynamic rules to route users into the correct OUs such as /Students/UG, /Faculty/Engineering and /Staff.

Technologies

Technologies used

Results

The outcome