# 1Password SCIM provisioning from Google Workspace

> Provision 1Password Business users and groups from Google Workspace through the 1Password SCIM bridge: deployment, bearer token and AnySCIM setup.

> **Prerequisite:** [connect Google Workspace to AnySCIM](/docs/google-workspace) first. You do it once, and every app you add syncs from that directory.

**1Password provisions users through the 1Password SCIM bridge, a small service you deploy in your own cloud.** Setting it up gives you two things: the bridge's URL and a bearer token. Most of this guide shows how to get them. In AnySCIM you then paste both and choose who gets 1Password.

## Before you start

- A **1Password Business** account.
- A 1Password **owner or administrator**.
- A place to run the bridge with a public HTTPS domain, for example `scim.example.com`. 1Password has one-click guides for Google Cloud, Azure, AWS and DigitalOcean, plus Docker and Kubernetes.

> **SCIM bridge or 1Password's own Google Workspace option?** 1Password can also read Google Workspace directly. Use one or the other. AnySCIM fits when you want 1Password managed with your other apps, with one scope, dry-run and audit log.

## Step 1: Generate the bridge credentials

1. Sign in to your account on 1Password.com and open **Integrations** in the sidebar.
2. Set up **automated user provisioning** with the self-hosted **SCIM bridge**. If provisioning is already set up with another integration, deactivate it first under **More Actions → Deactivate Provisioning**.
3. Generate the credentials. 1Password creates a **scimsession file** and a **bearer token**.
4. Click **Save in 1Password** to store both in a vault, and download the scimsession file.

The bearer token goes to AnySCIM. The scimsession file goes only to the bridge: never share it.

## Step 2: Deploy the SCIM bridge

1. Follow 1Password's deployment guide for your platform and give the bridge the **scimsession file**.
2. Point your domain, for example `scim.example.com`, at the bridge. Use a static IP address: an ephemeral one can change and stop provisioning.
3. Open the domain in a browser and sign in with the **bearer token**. The status page should show the bridge as healthy.

> **Tip:** the bridge accepts only the bearer token generated with its own scimsession file. A token from another 1Password integration, such as Events Reporting, won't work.

## Step 3: Add the token to AnySCIM

1. Open **Connections → New connection** and choose **1Password**.
2. In the base URL, replace `{scim_bridge_domain}` with your bridge's domain, for example `https://scim.example.com/scim`.
3. Paste the bearer token and click **Test connection**.
4. Choose who gets 1Password: tick the Google groups or organizational units. Turn on **Push group membership** to create 1Password groups from Google groups, then give those groups access to vaults in 1Password.
5. Check the dry-run and click **Activate connection**.

## Good to know

- **New users** get an invitation to create their 1Password account. Once they accept, the bridge confirms them without delay.
- **Provision Managers:** the bridge creates a group with this name to confirm users. In most cases, nobody should be added to it.
- **Protected groups:** groups with the **Recover Accounts** or **Manage All Groups** permissions, such as Owners and Administrators, aren't managed by provisioning.
- **Leavers:** when a Google user is suspended, they're suspended in 1Password.

## Troubleshooting

- **401 on every request:** the bearer token doesn't match the bridge's scimsession file. Regenerate the credentials, update the bridge and paste the new token into the connection.
- **404 on every request:** the base URL is missing `/scim`. It should end right where `/Users` begins.
- **Connection worked, then stopped:** the bridge's IP address or domain changed. Give it a static IP and check the status page.

## FAQ

### Which 1Password plan supports SCIM provisioning?

1Password Business. Automated provisioning connects your identity provider to your 1Password account through the SCIM bridge.

### Why does 1Password need a SCIM bridge?

1Password is end-to-end encrypted, so confirming new users needs keys that 1Password's servers never hold. The bridge runs in your infrastructure with the scimsession file and does that step for you.

### Can Google groups control 1Password vault access?

Yes. With **Push group membership** on, Google groups become 1Password groups. Give each group access to vaults once in 1Password, and membership then follows Google Workspace.