Target
- Access Control administrators
Purpose
- This article explains the procedure to disconnect Access Control from Google Workspace.
Notes
- The content of this article is based on the product specifications as of March 2026 and may be changed without prior notice.
- A Google Workspace super administrator account is required to perform this procedure.
- For instructions on how to access the Access Control Administration, please refer to the following article.
How to access the Access Control Administration - Before disconnecting Access Control, be sure to inform users of their Google Workspace login passwords in advance.
* After disabling Single Sign-On, users will log in using their Google Workspace login passwords.
Procedure
Preparation
Before disconnecting Single Sign-On, inform users of their Google Workspace login passwords in advance.
If a user has forgotten their Google Workspace login password, please reset it from the Google Workspace Admin console.
Reset a user's password in Google Workspace (external link)
Disabling Single Sign-On
- Access the Google Workspace Admin console and go to [Security] – [Authentication] – [SSO with third-party IdP].
- From the [Third-party SSO profiles] list, check the profile name used for SSO integration with Access Control and proceed to the corresponding procedure.
・If the SSO profile name is [Legasy SSO Profile], proceed to the section If the SSO profile name is Legasy SSO Profile.
・If the SSO profile name is anything other than [Legasy SSO Profile], proceed to If the SSO profile name is not Legasy SSO Profile.
If the SSO profile name is Legasy SSO Profile
- From the [Third-party SSO profiles] list, click the relevant [Legasy SSO Profile].
- On the edit screen, uncheck [Enable previous SSO profile] and set all of the following fields to blank:
- Login page URL
- Logout page URL
- Change password URL
- On the same screen, uncheck [Use domain-specific issuer] and click [Save].
- From the [Third-party SSO profiles] list, click [Manage SSO profile assignments] – [Manage].
- Confirm that the value for [Select SSO profile] for the organizational unit is set to [None]. If it is set to [Previous SSO profile], change the dropdown to [None] and click [Save].
* If SSO integration is enabled for all users, check the top-level organizational unit. If SSO integration is enabled for only some users, check the relevant organizational unit.
If the SSO profile name is not Legasy SSO Profile
- From the [Third-party SSO profiles] list, click [Manage SSO profile assignments] – [Manage].
- Select the organizational unit where SSO integration is enabled, change the [Select SSO profile] dropdown to [None], and click [Save].
* If SSO integration is enabled for all users, select the top-level organizational unit. If SSO integration is enabled for only some users, select the relevant organizational unit and remove the SSO profile assignment. - Return to the [SSO with third-party IdP] screen from step 1, and from [Third-party SSO profiles], select the profile used for SSO integration.
- On the edit screen, click [Delete], and then select [Delete] in the popup window that appears.
Disabling Other SSO Services
If you have services (other than Google Workspace) that are integrated with Access Control via Single Sign-On (SSO), please disable SSO for those services as well.
Check the targets in the [Connected Services] section of the Access Control Administration.
Additionally, SSO must be disabled from the connected service (SP) side.
For detailed instructions, please contact the support desk of each SP.
Deleting Synchronization Services
If you are synchronizing Active Directory with Access Control
* If you are not using the synchronization service (HDE One Directory Sync), no action is required.
Perform the following steps on the Windows server where HDE One Directory Sync is installed.
- Uninstall HDE One Directory Sync.
From [Control Panel] – [Programs and Features], uninstall the following program:
HDE One Directory Sync - Delete HDE One Directory Sync related files.
Manually delete the C:\Program Files\HDE One Directory Sync folder and all files directly under that folder. - Delete files under the HDEOne folder.
If the C:\HDEOne folder exists, manually delete that folder and all files directly under it.
If you are provisioning between Access Control and Google Workspace
* If you are not provisioning with Google Workspace, no action is required.
Perform the following steps in both the Access Control Administration and Google Workspace.
- From the Access Control Administration, go to [System] – [Provisioning Settings], then click [Check details page] to the right of [Full Sync] – [Google Workspace].
- When the Google provisioning settings are displayed, turn off both [Account provisioning] and [Password provisioning], then click [Save Changes].
- From the Google Workspace Admin console, go to [Security] – [Access and data control] – [API controls], and click [Manage domain-wide delegation].
- Delete the entry where the "Name" is "HENNGE Access Control" and the end of the "Scopes" matches the following.
* To confirm the name, hover over the row you want to check and click [Show detail] displayed on the right.- admin.directory.user
- https://mail.google.com/
Deleting "More" Links
* If you have not set up "More" links, no action is required.
Log in to the Google Workspace Admin console, and from [Apps] – [Google Workspace Marketplace apps] – [App list], delete the relevant service link if it exists.
User Tasks
* If you do not have a contract for Secure Browser app or Device Certificates, no action is required.
Please uninstall the Secure Browser app and Device Certificates from each user's device.
Even if they remain, they will not affect the device, but continued use will not be possible.