# Canva SCIM provisioning from Google Workspace

> Create and deprovision Canva Enterprise accounts from Google Workspace with the Canva SCIM API: SSO prerequisite, access token and AnySCIM setup.

**Canva supports SCIM provisioning on Canva Enterprise and Canva for Education, once SSO is set up.** A team admin or owner turns on SCIM in Canva's settings and copies an access token. AnySCIM uses it with `https://www.canva.com/_scim/v2` to give people in Google Workspace a Canva account on your team and deprovision them when they leave.

## Requirements

- A **Canva Enterprise** single team, or **Canva for Education**. Multi-team organizations and Canva for Teams don't have SCIM access.
- **SSO** configured for your team. Without it, Canva rejects SCIM requests.
- Your email domain **authorized for SCIM** in Canva.
- A Canva **team admin or owner**.

## Get the Canva access token

1. In Canva, open **Settings** from your profile menu and go to **SSO and provisioning**.
2. In the **Single Sign-On (SSO)** section, click **Manage**, then **Configure Provisioning**.
3. Under **Provision Accounts for your team**, select **Add provisioning method** and choose **SCIM**.
4. Turn on **Enable SCIM user provisioning** and copy the access token.

> **Careful:** Canva generates a new token every time you toggle that switch. If someone turns SCIM off and on again, paste the new token into AnySCIM.

## Connect Canva in AnySCIM

1. Open **Connections → New connection** and choose **Canva**.
2. The base URL is pre-filled with `https://www.canva.com/_scim/v2`. Paste the token and click **Test connection**.
3. In **Scope**, select the people who should have Canva. Leave **Push group membership** off: Canva's SCIM API doesn't support groups.
4. Review the dry-run and activate.

## How users are synced

- New users in scope get a Canva account on your team, with their Google email as `userName` and as their single work email.
- New accounts get the **Member** role. Change roles in Canva.
- Name changes are pushed with `PATCH`.
- When a Google user is suspended, AnySCIM sets `active: false` and Canva deprovisions the user. Designs they didn't transfer stay with the team without an owner, and they get them back if they're provisioned again. Ask leavers to transfer their designs first.

## Troubleshooting

- **400 "No SSO configurations found":** set up SSO for your team before enabling SCIM.
- **403 "Email domain not authorized for SCIM":** the user's domain isn't authorized in Canva. Add it, or take those users out of scope.
- **409 "Account with email already exists":** the person already has a Canva account with that email. They need to sign in once with SSO to confirm it's theirs; the next sync then succeeds.
- **Slow first sync:** Canva limits user creation to one request per second, so a large first sync takes a while. AnySCIM retries requests that hit the limit.

## FAQ

### Which Canva plans support SCIM?

Canva Enterprise (single teams) and Canva for Education. Canva for Teams and multi-team organizations don't have SCIM access.

### Can Google groups be synced to Canva?

No. Canva's SCIM API provisions users only and doesn't support groups, so leave **Push group membership** off for this connection.

### What happens to a user's designs when they leave?

AnySCIM sends `active: false` and Canva deprovisions the user. Designs they didn't transfer stay with your team without an owner. If they're provisioned again later, they regain them.