Bitwarden SCIM provisioning from Google Workspace

Bitwarden supports SCIM on Teams and Enterprise organizations. When you enable SCIM in the Admin Console, Bitwarden shows a SCIM URL and an API key. AnySCIM uses them to invite people from Google Workspace into your organization, sync Google groups to Bitwarden groups and revoke access when people leave.

Requirements

• A Bitwarden Teams or Enterprise organization.
• Access to the organization's Settings in the Admin Console.
• A Google Workspace source already connected. See Connect Google Workspace.

Enable SCIM in Bitwarden

1. Open the Bitwarden Admin Console for your organization.
2. Go to Settings → SCIM provisioning and check Enable SCIM.
3. Copy the SCIM URL and the SCIM API key, then save. The SCIM API key is separate from the organization API key used by Bitwarden's Public API.

Connect Bitwarden in AnySCIM

1. Open Connections → New connection and choose Bitwarden.
2. Paste the SCIM URL as the base URL and the SCIM API key as the token, then click Test connection.
3. In Scope, select the people who should have Bitwarden. Turn on Push group membership to create Bitwarden groups from Google groups, then give those groups access to collections in Bitwarden.
4. Review the dry-run and activate.

How users are synced

• New users in scope are added to the organization with their Google email as both userName and primary email, which is what Bitwarden expects.
• Whether invitations go out is up to Bitwarden's Automatically send email invitations setting. With it off, provisioned users stay Staged: they don't get an invitation, don't use a seat and aren't subject to organization policies until you invite them.
• Invited users accept the invitation, then an admin confirms them. This step completes the key exchange that lets them decrypt shared vault data.
• When a Google user is suspended, AnySCIM sets active: false and Bitwarden revokes the member. Their access ends, and you can restore it later.

Troubleshooting

• A user changed their email in Google: Bitwarden doesn't support changing a member's email after provisioning. Revoke the old member and provision the new address.
• Members stay in "Accepted": an admin still needs to confirm them in the Admin Console.
• Seats used by people who never signed in: turn off automatic invitations so new users stay Staged until you invite them.

FAQ

Which Bitwarden plans support SCIM?

Teams and Enterprise organizations. Bitwarden's Free and Families plans don't include SCIM.

What happens to a Bitwarden member when they leave?

When their Google account is suspended, AnySCIM sends active: false and Bitwarden revokes the member, ending their access to organization vault data.

Can Google groups control Bitwarden collections?

Yes. With Push group membership enabled, Google groups become Bitwarden groups. Give each group access to collections once in Bitwarden, and membership then follows Google Workspace.