Canva SCIM provisioning from Google Workspace

Canva supports SCIM provisioning on Canva Enterprise and Canva for Education, once SSO is set up. A team admin or owner turns on SCIM in Canva's settings and copies an access token. AnySCIM uses it with https://www.canva.com/_scim/v2 to give people in Google Workspace a Canva account on your team and deprovision them when they leave.

Requirements

• A Canva Enterprise single team, or Canva for Education. Multi-team organizations and Canva for Teams don't have SCIM access.
• SSO configured for your team. Without it, Canva rejects SCIM requests.
• Your email domain authorized for SCIM in Canva.
• A Canva team admin or owner.

Get the Canva access token

1. In Canva, open Settings from your profile menu and go to SSO and provisioning.
2. In the Single Sign-On (SSO) section, click Manage, then Configure Provisioning.
3. Under Provision Accounts for your team, select Add provisioning method and choose SCIM.
4. Turn on Enable SCIM user provisioning and copy the access token.

Connect Canva in AnySCIM

1. Open Connections → New connection and choose Canva.
2. The base URL is pre-filled with https://www.canva.com/_scim/v2. Paste the token and click Test connection.
3. In Scope, select the people who should have Canva. Leave Push group membership off: Canva's SCIM API doesn't support groups.
4. Review the dry-run and activate.

How users are synced

• New users in scope get a Canva account on your team, with their Google email as userName and as their single work email.
• New accounts get the Member role. Change roles in Canva.
• Name changes are pushed with PATCH.
• When a Google user is suspended, AnySCIM sets active: false and Canva deprovisions the user. Designs they didn't transfer stay with the team without an owner, and they get them back if they're provisioned again. Ask leavers to transfer their designs first.

Troubleshooting

• 400 "No SSO configurations found": set up SSO for your team before enabling SCIM.
• 403 "Email domain not authorized for SCIM": the user's domain isn't authorized in Canva. Add it, or take those users out of scope.
• 409 "Account with email already exists": the person already has a Canva account with that email. They need to sign in once with SSO to confirm it's theirs; the next sync then succeeds.
• Slow first sync: Canva limits user creation to one request per second, so a large first sync takes a while. AnySCIM retries requests that hit the limit.

FAQ

Which Canva plans support SCIM?

Canva Enterprise (single teams) and Canva for Education. Canva for Teams and multi-team organizations don't have SCIM access.

Can Google groups be synced to Canva?

No. Canva's SCIM API provisions users only and doesn't support groups, so leave Push group membership off for this connection.

What happens to a user's designs when they leave?

AnySCIM sends active: false and Canva deprovisions the user. Designs they didn't transfer stay with your team without an owner. If they're provisioned again later, they regain them.