Set up automated user provisioning with custom SCIM profiles (beta)

Automated user provisioning with custom SCIM profiles is a beta feature available only to a limited number of participants. If you don't see Autoprovisioning on your app's details page, it isn't available for your organization yet.

You can automatically set up and manage user accounts in custom or pre-integrated SAML app that supports SCIM 2.0 by using automated user provisioning with custom SCIM profiles.

Before you begin

To set up a custom SCIM profile, you need to have:

• A Cloud Identity account with a super administrator role. For details, go to Prebuilt administrator roles.
• A custom or pre-integrated SAML app set up and turned on for users in your Admin console

Your app needs to have a SCIM server that:

• Supports SCIM version 2.0
• Uses standard HTTP methods, including POST, GET, PATCH with fallback to PUT, and DELETE
• Supports Bearer Token authentication. OAuth token authentication is not supported.

Set up automated user provisioning with a custom SCIM profile

1. In the Google Admin console, go to Menu Apps Web and mobile apps.

   Go to Web and mobile apps

   You must be signed in as a super administrator for this task.

2. Click the name of your SAML app.
3. Under Autoprovisioning, click Configure auto-provisioning.
4. Enter the bearer token from your app in Access token, then click Continue.
5. Enter the SCIM endpoint URL from your app in the Endpoint URL field, then click Continue. Google connects to your SCIM endpoint to automatically discover supported attributes.
6. Map your Google Directory attributes to the corresponding app attributes. If your app supports schema discovery, the table is pre-populated with discovered attributes. To map custom attributes manually, click Add mapping Continue when you're finished.
7. (Optional) If you don't add any groups, all users with access to the SAML app are provisioned. To limit autoprovisioning to specific groups of users:
   • For Search groups, enter one or more letters of the group name, select the group name, and choose a scope.
   • Add any additional groups.
   • (Optional) To remove a group, click Remove.
     If a group has users from a secondary domain or from outside of your organization, those users are not provisioned.
8. Decide how long users keep access to the app after the app is turned off for them, or after their Google Workspace account is suspended or deleted. You can choose to suspend their account, hard delete their account, or suspend and then hard delete their account. You can set the delay timeframe individually for each action.
   1. Choose options for each of these events, as needed:
      • When an app is turned off for a user
      • When a user is suspended from Google
      • When a user is deleted from Google
        If you suspend a user account, it's marked as deactivated. If you hard delete the user account, it's permanently removed from the app. Always set more time before hard deleting a user's account. For details about suspension and deletion go to Edit deprovisioning time frames.
   2. Click Continue.

9. Test the connection:

   1. For Google Directory user, search for and select a user who doesn't have an account in your app.

   2. Click Test.
      

      Google creates an account for the user in your app, updates it, and then deletes it. Each operation shows Success, Failed, or Not run. For a failed operation, review the HTTP code, SCIM error type, and View raw response details from your app.
      

      Note: If your app doesn't return 201 Created for the new user, for example because the user already exists, Create User fails and Google skips the update and delete operations. If Delete User fails, delete the test account in your app manually.

10. Click Finish.
    You can click Finish even if the test failed, and test again later. This step saves the configuration but doesn't turn on autoprovisioning. To turn it on, go to your app's details page Autoprovisioning and set the toggle to Active.
    Note: The setting is disabled if your app isn't turned on for any users. Click User access and turn the app on to enable turning on autoprovisioning.

Edit provisioning information

Turn off autoprovisioning & delete configuration information

You can turn off autoprovisioning for the app without losing configuration information. Or, you can turn off autoprovisioning and remove all configuration information.

Review usage information

• After you turn on autoprovisioning, you can review usage information. For details, go to Monitor automated user provisioning.
• You can review the following usage information for the last 30 days:

Admin log event	Description
Create User By Auto Provisioning	Users created by autoprovisioning
Update Auto Provisioned User	Users updated by autoprovisioning
Suspend Auto Provisioned User	Users suspended by autoprovisioning
Unsuspend Auto Provisioned User	Users reactivated by autoprovisioning
Hard Delete Auto Provisioned User	Users deleted by autoprovisioning
Failures	Failed requests

If autoprovisioning stops working

Autoprovisioning stops working if Google can no longer connect to your app. For example, the bearer token might have expired or been revoked, or the app's SCIM URL might have changed. To fix it, update the token or URL:

1. In the Google Admin console, go to Menu Apps Web and mobile apps.

   Go to Web and mobile apps

   You must be signed in as a super administrator for this task.

2. Click the name of your SAML app.
3. Click Autoprovisioning.
4. To update the bearer token:
   1. For App authorization, click Reauthorize.
   2. For Access token, paste a new bearer token from your app.
   3. Click Reauthorize.
5. To update the SCIM base URL, for Endpoint URL, click Edit, enter the new URL, and then click Update.
6. (Optional) To verify the connection, for Test connection, click Test.

For details on other reasons why autoprovisioning might stop working, refer to the app's documentation.