How to Configure Google Workspace Cloud Identity Automated Provisioning (SCIM)

The Provisioning Bottleneck

When an enterprise hires 50 new employees, the IT department must manually create 50 accounts in Active Directory. But the work doesn’t stop there. They must also log into Salesforce and create 50 accounts, log into Slack and create 50 accounts, and log into Zoom and create 50 accounts. When an employee is suddenly terminated, the IT team must scramble to manually disable access in all four systems. If they forget to disable the Salesforce account, a disgruntled former employee can steal the entire client database.

To solve this massive security and administrative nightmare, Google Workspace utilizes Automated Provisioning via SCIM (System for Cross-domain Identity Management). SCIM is an open standard API protocol. By configuring Google Workspace as the SCIM Identity Provider (IdP), Google acts as the absolute source of truth. When you create a user in Google Workspace, Google automatically reaches out via an API tunnel to Salesforce, Slack, and Zoom, and instantly creates the accounts there. When you suspend a user in Google Workspace, Google instantly sends a “Disable” API command to every single third-party app simultaneously.

Step 1: Preparing the Service Provider (e.g., Slack)

Before Google can push users into a third-party application, that application must open a secure API tunnel and provide an authentication token.

1. Log into your third-party application (e.g., the Slack Admin Console).
2. Navigate to the Identity Management or Provisioning settings.
3. Enable SCIM Provisioning.
4. The application will generate two critical pieces of information: a Tenant URL (e.g., https://api.slack.com/scim/v2) and an incredibly long alphanumeric OAuth Secret Token. Copy both of these to a secure notepad.

Step 2: Configuring the SCIM Connection in Google Workspace

You must now teach Google how to connect to the third-party application.

1. Log into the Google Workspace Admin Console as a Super Administrator.
2. Navigate to Apps > Web and mobile apps.
3. Click on the specific SAML application you are configuring (e.g., Slack). (Note: You must have already configured SAML SSO for the app before you can configure SCIM provisioning).
4. Click on Autoprovisioning.
5. Click Set up autoprovisioning.
6. Google will ask for the Endpoint URL and the Secret Token. Paste the values you copied from Slack in Step 1.
7. Click Test Connection. Google will fire a test API packet to Slack. If Slack accepts the token, you will get a green success checkmark.

Step 3: Attribute Mapping (The Data Translation)

Google knows the employee’s “First Name”, but Slack might refer to that exact same field as “givenName” in its database. You must configure the translation map.

1. Click Next to reach the Attribute Mapping screen.
2. Google provides a default mapping for popular apps, but you must verify it. Ensure that the Primary Email field in Google maps perfectly to the userName field in Slack.
3. You can map advanced attributes, such as mapping the Google Workspace Department field to the Slack Title field.
4. Click Finish.

Step 4: Defining the Provisioning Scope

You do not want Google to blindly push all 10,000 corporate users into Salesforce if you only purchased 500 Salesforce licenses. You must restrict the scope.

1. On the Autoprovisioning summary page, click Provisioning Scope.
2. Select Only specific groups or organizational units.
3. Select the Sales Team Google Group.
4. Click Save.

Step 5: Activating the Engine

The configuration is complete, but the engine is currently dormant.

1. On the Autoprovisioning summary page, locate the Autoprovisioning status toggle.
2. Flip it from Off to ON.

The Automation in Action

The moment you flip the switch, Google Workspace executes a massive background sync. It analyzes the Sales Team group. It finds 50 users. It rapidly fires 50 SCIM API calls to Salesforce, instantly creating the accounts, assigning them licenses, and populating their names and titles.

Going forward, if you hire a new salesperson and simply add them to the Sales Team Google Group, the Google SCIM engine will detect the group membership change and automatically provision their Salesforce account within seconds. True zero-touch IT deployment is achieved.