# Bitwarden SCIM provisioning from Google Workspace

> Invite, update and revoke Bitwarden organization members and groups from Google Workspace with Bitwarden SCIM on Teams or Enterprise. Setup with AnySCIM.

**Bitwarden supports SCIM on Teams and Enterprise organizations.** When you enable SCIM in the Admin Console, Bitwarden shows a SCIM URL and an API key. AnySCIM uses them to invite people from Google Workspace into your organization, sync Google groups to Bitwarden groups and revoke access when people leave.

## Requirements

- A Bitwarden **Teams** or **Enterprise** organization.
- Access to the organization's **Settings** in the Admin Console.
- A Google Workspace source already connected. See [Connect Google Workspace](/docs/google-workspace).

> **SCIM or Directory Connector?** Bitwarden also offers Directory Connector, which reads Google Workspace directly. Use one or the other: AnySCIM fits when you want Bitwarden managed alongside your other apps, with one scope, dry-run and audit log.

## Enable SCIM in Bitwarden

1. Open the Bitwarden **Admin Console** for your organization.
2. Go to **Settings → SCIM provisioning** and check **Enable SCIM**.
3. Copy the **SCIM URL** and the **SCIM API key**, then save. The SCIM API key is separate from the organization API key used by Bitwarden's Public API.

## Connect Bitwarden in AnySCIM

1. Open **Connections → New connection** and choose **Bitwarden**.
2. Paste the **SCIM URL** as the base URL and the **SCIM API key** as the token, then click **Test connection**.
3. In **Scope**, select the people who should have Bitwarden. Turn on **Push group membership** to create Bitwarden groups from Google groups, then give those groups access to collections in Bitwarden.
4. Review the dry-run and activate.

## How users are synced

- New users in scope are added to the organization with their Google email as both `userName` and primary email, which is what Bitwarden expects.
- Whether invitations go out is up to Bitwarden's **Automatically send email invitations** setting. With it off, provisioned users stay **Staged**: they don't get an invitation, don't use a seat and aren't subject to organization policies until you invite them.
- Invited users accept the invitation, then an admin **confirms** them. This step completes the key exchange that lets them decrypt shared vault data.
- When a Google user is suspended, AnySCIM sets `active: false` and Bitwarden **revokes** the member. Their access ends, and you can restore it later.

## Troubleshooting

- **A user changed their email in Google:** Bitwarden doesn't support changing a member's email after provisioning. Revoke the old member and provision the new address.
- **Members stay in "Accepted":** an admin still needs to confirm them in the Admin Console.
- **Seats used by people who never signed in:** turn off automatic invitations so new users stay Staged until you invite them.

## FAQ

### Which Bitwarden plans support SCIM?

Teams and Enterprise organizations. Bitwarden's Free and Families plans don't include SCIM.

### What happens to a Bitwarden member when they leave?

When their Google account is suspended, AnySCIM sends `active: false` and Bitwarden revokes the member, ending their access to organization vault data.

### Can Google groups control Bitwarden collections?

Yes. With **Push group membership** enabled, Google groups become Bitwarden groups. Give each group access to collections once in Bitwarden, and membership then follows Google Workspace.