Asana SCIM provisioning from Google Workspace

Asana supports SCIM provisioning on Enterprise plans through a service account. A super admin creates a service account limited to user provisioning, and AnySCIM uses its token with https://app.asana.com/api/1.0/scim to add, update and deprovision Asana users from Google Workspace.

Requirements

• An Asana Enterprise or Enterprise+ organization.
• A super admin to create the service account.

Create the service account token

1. In the Asana Admin console, open Apps → Service accounts and add a service account.
2. Limit its permissions to user provisioning (SCIM), so the token cannot read your projects.
3. Copy the token. Asana shows it only once.

Connect Asana in AnySCIM

1. Open Connections → New connection and choose Asana.
2. The base URL is pre-filled with https://app.asana.com/api/1.0/scim. Paste the token and click Test connection.
3. In Scope, select the groups or organizational units that should use Asana.
4. Review the dry-run and activate.

How users are synced

• New users in scope are added to your Asana organization, matched by email.
• Name and title changes are pushed with PATCH.
• A suspended Google user is sent as active: false, which deprovisions them in Asana. Their tasks stay in place and can be reassigned.

FAQ

Which Asana plans support SCIM?

Enterprise and Enterprise+. Service accounts, which issue the SCIM token, are only available on those plans.

Why use a service account instead of a personal access token?

A service account is not tied to a person, so provisioning keeps working when admins change, and its permissions can be limited to user provisioning only.

What happens to tasks when a user is deprovisioned?

They remain in Asana. An admin can reassign the user's tasks after deprovisioning.