anchor.diff:  Log into your [Google Admin Console](https://admin.google.com), and follow these instructions:
   
   1. In the 'Apps' area of the console, select the 'Web and mobile apps' submenu.
  -1. Click the 'Add App" menu at the top of the table and choose 'Add custom SAML app'
  -1. Give your application a name, for example 'Buildkite'.
  +1. Click the 'Add App" menu at the top of the table and choose 'Search for apps'
  +1. Search for 'Buildkite', and select 'Buildkite Web (SAML)'
   1. Copy down the SSO URL and Entity ID, and download the Certificate. You'll need these in Step 3.
   1. Enter the following Service Provider Details:
  -    * ACS URL: the URL you copied in Step 1
  +    * ACS URL: the URL you copied in Step 1. Replace any existing value suggested by Google.
       * Entity ID: https://buildkite.com
   1. Attribute mapping can be added after the initial setup and testing. Click 'Finish' to complete the setup.
   
  
positive.code: <div class="Docs__note">
    <p>You can also set up SSO providers manually with GraphQL. See the <a href="/docs/integrations/sso/sso-setup-with-graphql">SSO Setup with GraphQL Guide</a> for detailed instructions and code samples.</p>
  </div>
  
  ## Step 1. Create a Buildkite SSO Provider
  
  
negative.code: 
  Follow the instructions on the provider page to perform a test login. Performing a test login will verify that SSO is working correctly before you activate it for your organization members.
  
  <div class="Docs__troubleshooting-note">
    <p>Google warn that "Changes may take up to 24 hours to propagate to all user". We've observed some changes taking at least several hours, so if the test login fails it is worth waiting a while and trying again.</p>
  </div>
  
  ## Step 4. Enable the new SSO Provider
  
  Once you've performed a test login you can enable your provider using the `Enable` button. Activating SSO will not force a log out of existing users, but will cause all new or expired sessions to authorize through Google Workspace before organization data can be accessed.
  