# Asana SCIM provisioning from Google Workspace

> Provision Asana users from Google Workspace with SCIM, using a service account token with the user provisioning scope on Asana Enterprise.

**Asana supports SCIM provisioning on Enterprise plans through a service account.** A super admin creates a service account limited to user provisioning, and AnySCIM uses its token with `https://app.asana.com/api/1.0/scim` to add, update and deprovision Asana users from Google Workspace.

## Requirements

- An **Asana Enterprise** or **Enterprise+** organization.
- A **super admin** to create the service account.

## Create the service account token

1. In the Asana **Admin console**, open **Apps → Service accounts** and add a service account.
2. Limit its permissions to **user provisioning (SCIM)**, so the token cannot read your projects.
3. Copy the token. Asana shows it only once.

## Connect Asana in AnySCIM

1. Open **Connections → New connection** and choose **Asana**.
2. The base URL is pre-filled with `https://app.asana.com/api/1.0/scim`. Paste the token and click **Test connection**.
3. In **Scope**, select the groups or organizational units that should use Asana.
4. Review the dry-run and activate.

## How users are synced

- New users in scope are added to your Asana organization, matched by email.
- Name and title changes are pushed with `PATCH`.
- A suspended Google user is sent as `active: false`, which deprovisions them in Asana. Their tasks stay in place and can be reassigned.

## FAQ

### Which Asana plans support SCIM?

Enterprise and Enterprise+. Service accounts, which issue the SCIM token, are only available on those plans.

### Why use a service account instead of a personal access token?

A service account is not tied to a person, so provisioning keeps working when admins change, and its permissions can be limited to user provisioning only.

### What happens to tasks when a user is deprovisioned?

They remain in Asana. An admin can reassign the user's tasks after deprovisioning.