Google Workspace SCIM Bridge

This guide walks you through setting up the the platform Bridge to automatically synchronize users from Google Workspace into the platform via SCIM.

Prerequisites

• Google Workspace administrator access (to create OAuth credentials)
• the platform organization administrator access
• A Google Cloud project with the Admin SDK API enabled

How It Works

The Google Workspace Bridge connects to Google’s Admin Directory API using OAuth2, retrieves your organization’s user directory, and synchronizes it with the platform through the SCIM endpoint. The Bridge runs on a regular schedule and handles:

• New users: Creates the platform accounts for users found in Google Workspace
• Updated users: Syncs attribute changes (name, title, department, etc.)
• Removed users: Deactivates the platform accounts for users no longer in Google Workspace
• Excluded users: Skips users you’ve explicitly excluded by email

Mapped Attributes

Google Workspace Field	SCIM Attribute
Primary email	userName, emails
Display name	displayName
First name	name.givenName
Last name	name.familyName
Suspended status	active
Job title	title
Type of employee	userType
Department	enterprise:department
Cost center	enterprise:costCenter
Employee ID	enterprise:employeeNumber
Manager email	enterprise:manager
Language	preferredLanguage

Step 1: Create Google OAuth Credentials

1. Go to the Google Cloud Console

2. Select or create a project for the platform integration

3. Go to APIs & Services > Enabled APIs & Services

4. Click + Enable APIs and Services and enable the Admin SDK API

5. Go to APIs & Services > Credentials

6. Click + Create Credentials > OAuth client ID

7. Configure the OAuth consent screen if prompted:

   Field	Value
   App name	Probo SCIM Bridge
   User support email	Your admin email
   Scopes	https://www.googleapis.com/auth/admin.directory.user.readonly

8. Create the OAuth client ID:

   Field	Value
   Application type	Web application
   Name	Probo SCIM Bridge
   Authorized redirect URIs	https://your-probo-domain.com/api/console/v1/connectors/complete

9. Save the Client ID and Client Secret

Step 2: Configure the Bridge in the platform

1. Log in to the platform as an organization administrator

2. Go to Organization Settings > Authentication > Auto-Provisioning

3. Click Add Connector and select Google Workspace

4. Enter your OAuth credentials:

   Field	Value
   Client ID	Your Google OAuth Client ID
   Client Secret	Your Google OAuth Client Secret

5. Click Authorize to complete the OAuth flow — you’ll be redirected to Google to grant access

6. After authorization, the Bridge connector will appear as Pending

Step 3: Configure Exclusions (Optional)

If you have service accounts, shared mailboxes, or other users that should not be provisioned into the platform:

1. In the Bridge connector settings, go to Excluded Users
2. Add email addresses of users to exclude (case-insensitive)
3. Click Save

Excluded users will be skipped during synchronization. If an excluded user was previously provisioned, they will be removed on the next sync cycle.

Step 4: Verify Synchronization

After the Bridge is configured, it will begin synchronizing on its regular schedule (approximately every 30 seconds for polling, with a 5-minute sync timeout).

1. Go to Organization Settings > Authentication > Auto-Provisioning
2. Check the Bridge state — it should transition from Pending to Syncing and then to Active
3. Go to People to verify users have been provisioned
4. Check the Event Log for detailed sync activity

Setting a User’s Role

the platform membership roles (Owner, Admin, and so on) are assigned in People or mapped with the SAML Role Attribute. SCIM creates people as Employee by default.

Separately, syncing a job title and employment type helps the platform attribute policies and run meaningful access reviews. Without those profile fields, a user can still sign in but is harder to evaluate for least-privilege access.

Google Workspace syncs two relevant fields to the platform via the SCIM bridge:

• Job title → the user’s position (for example, Software Engineer, Finance Manager, IT Administrator)
• Type of employee → their employment type (for example, Full-time, Part-time, Intern, Contractor, Freelance)

1. In the Google Admin console, go to Directory → Users
2. Select the user you want to update
3. Open User information → Employee information
4. Set the Job title field to the user’s position
5. Set the Type of employee field to their employment type
6. Click Save
7. On the next sync, both values appear on the user’s profile in the platform

Sfat

Keep job titles consistent across your team (avoid free-form variations like Eng, SWE, Engineer for the same role) so access reviews group people cleanly.

Troubleshooting

Bridge Stuck in “Pending”

• Cause: OAuth authorization was not completed or the token has expired
• Solution: Re-authorize the Google Workspace connector by clicking Authorize again

Bridge in “Failed” State

• Cause: The sync encountered an error (network issue, API rate limit, invalid credentials)
• Solution: Check the Event Log for error details. The Bridge will automatically retry with exponential backoff. If the issue persists after 10 consecutive failures, the Bridge will be disabled — fix the underlying issue and re-enable it manually.

Users Not Appearing

• Cause: The Google OAuth scope may not include directory access, or users are in an organizational unit not visible to the admin account
• Solution: Verify the Admin SDK API is enabled and the OAuth consent screen includes the admin.directory.user.readonly scope

Stale Users Not Deactivated

• Cause: Users may be in the exclusion list, or the sync hasn’t completed a full cycle yet
• Solution: Check the exclusion list and wait for the next sync cycle. Each sync processes up to 500 users per page from Google Workspace.

OAuth Token Expired

• Cause: The refresh token has been revoked or expired
• Solution: Re-authorize the connector. The Bridge automatically refreshes OAuth tokens, but if the refresh token itself is revoked (e.g., user removed app access in Google), you’ll need to re-authorize.

Combining with SSO

For the best experience, combine SCIM Bridge provisioning with SAML SSO:

1. SCIM Bridge handles user lifecycle — creating and deactivating accounts automatically
2. SAML SSO handles authentication — users sign in with their Google credentials

This means users get automatic the platform accounts when they join your organization and lose access when they leave, with no manual account management needed.

Google Workspace SSO Set up SAML SSO alongside SCIM provisioning

SCIM Overview Compare Native and Bridge synchronization modes