SCIM with Google Workspace

This page walks a Conduit admin through connecting Google Workspace to Conduit with SCIM 2.0, so Google automatically creates, updates, and deactivates Conduit users — and materializes Google groups as Conduit teams — without managing membership by hand.

You need two things before you start:

• Owner or Admin on the Conduit organization (to generate the SCIM token).
• A Google Workspace super admin. Regular Google admins lack provisioning rights, and Google auto-provisioning requires a plan that includes Cloud Identity Premium (or equivalent).

Caution

Google Workspace is the most limited of the IdPs Conduit supports. It has no on-demand sync, sends PUT-style replaces for most updates, has limited PATCH support, and flattens nested groups. Conduit handles everything Google sends, so no workarounds are needed on your side — but if you also run Entra ID, Okta, or JumpCloud, prefer one of those. See the SCIM overview for the full comparison.

---

Step 1 — Generate the SCIM token in Conduit

This first step is the same for every IdP. In Conduit:

1. Go to Provisioning (/org/scim).
2. Click Connect IdP.
3. Choose Google Workspace as the IdP.
4. Pick the default role new SCIM-provisioned users will receive — member is the safe default.
5. Click Generate token.
6. Copy the Tenant URL and Secret token. They are shown only once — keep the tab open while you configure Google.

The Tenant URL looks like https://conduit.wyre.ai/scim/v2/…. These two values are everything Google needs. For the shared concepts behind this flow, see the SCIM overview.

---

Step 2 — Add the custom SAML / SCIM app in Google

1. In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app.
2. Name the app (e.g. “Conduit”), then click Continue.
3. Skip the SAML configuration — only provisioning is used, not SSO. Click Continue → Finish.

Step 3 — Configure auto-provisioning

1. From the app’s page, click Auto-provisioning.
2. Under SCIM connector configuration, set:
   • Endpoint URL = the Conduit Tenant URL.
   • Bearer token = the Conduit Secret token.
3. Click Test connection and expect success.
4. Attribute mapping: keep the defaults. Conduit maps the standard SCIM attributes without customization.
5. Provisioning scope: choose which org units and/or groups to sync. Anything outside this scope is silently ignored by Google.
6. Deprovisioning: choose Suspend the user. In Conduit this maps to marking the user inactive (active = false), which is re-activatable.
7. Click Save, then toggle the Auto-provisioning switch on.

Google syncs approximately every 30 minutes — there is no “sync now” button, so allow up to half an hour for the first users and groups to appear.

What gets provisioned

Google Workspace action	Result in Conduit
User in the provisioning scope	Conduit user + org membership at the connection’s default role
Group synced to the app	A Conduit team with a member for each user in the group
User suspended or moved out of scope	Org membership removed; user marked inactive (re-activatable)

Note

SCIM creates a “shadow” user record keyed by email. A provisioned user must still sign in through Conduit’s existing SSO — on first sign-in the shadow record binds to their identity.

---

How Conduit handles Google Workspace

Google’s SCIM client is less spec-compliant than the others: it sends PUT-style replaces instead of targeted PATCH operations, offers only limited PATCH support, and flattens nested groups before it sends them. You do not need to work around any of this. Conduit normalizes what Google sends and provisions the users and teams accordingly — the only practical differences you will notice are the ~30-minute sync interval and the absence of an on-demand sync.

---

Verify

After the first sync (up to ~30 minutes), confirm in Conduit:

• /org/members — the provisioned users appear at the default role you chose.
• /org/teams — each synced Google group shows up as a Conduit team with its members.

---

Troubleshooting

• “This service is not available” on the SCIM connector page — your Workspace plan doesn’t include SCIM provisioning. Upgrade to Cloud Identity Premium (or an equivalent plan).
• Bearer token rejected / test connection fails — re-copy the Secret token, making sure no quotes or whitespace were added when pasting. If it still fails, the token may have been revoked or superseded; generate a fresh one in Conduit at /org/scim and paste it again.
• Users not appearing — confirm the user is inside an org unit or group that falls within the app’s provisioning scope. Users outside the scope are silently ignored by Google.
• Nothing has synced yet — Google has no on-demand sync and runs roughly every 30 minutes. Wait for the next cycle before assuming a misconfiguration.
• A group’s members are missing — make sure the group itself is included in the provisioning scope, not just the individual users. Nested subgroups are flattened by Google, so members of a subgroup are provisioned as members of the parent group’s Conduit team.

---

Revoking access

To disconnect Google Workspace: in Conduit, go to Provisioning (/org/scim) and click Revoke on the connection. The token is invalidated immediately, and Google receives a 401 on its next sync. Teams and users the connection created remain in place until you remove them manually. See the SCIM overview for details.