# Datadog SCIM provisioning from Google Workspace

> Provision and disable Datadog users from Google Workspace with the Datadog SCIM API: service account, application key, site URL and AnySCIM setup.

> **Prerequisite:** [connect Google Workspace to AnySCIM](/docs/google-workspace) first. You do it once, and every app you add syncs from that directory.

**Datadog has a SCIM 2.0 API at `https://api.datadoghq.com/api/v2/scim`, called with the application key of a service account.** Most of this guide shows how to create that service account and its key. In AnySCIM you then paste the key, check the URL for your Datadog site and choose who gets Datadog.

## Before you start

- A Datadog **Infrastructure Pro** or **Enterprise** plan.
- A Datadog **admin** who can create service accounts.
- Your **Datadog site**, shown in the address bar when you sign in, for example `app.datadoghq.com` or `app.datadoghq.eu`.

## Step 1: Create the Datadog service account and application key

1. In Datadog, open **Organization Settings** from your account menu.
2. Under **Accounts**, select **Service Accounts** and click **New Service Account**.
3. Enter a name, for example `AnySCIM`, and an email address your team reads.
4. In **Assign Roles**, choose **Datadog Admin Role**, or a custom role with the `user_access_invite` and `user_access_manage` permissions. Click **Create Service Account**.
5. Select the new service account. In its side panel, click **New Key**, name it, for example `anyscim-scim`, and click **Create Key**.
6. Copy the key now. Datadog shows a service account's application key only once.

> **Why a service account?** If you use a personal application key and its owner leaves, Datadog deprovisions them and revokes the key, and provisioning stops. A service account's key keeps working.

## Step 2: Add the key to AnySCIM

The base URL uses the **API host** of your Datadog site, not the app host:

| Your Datadog site | Base URL |
| --- | --- |
| `app.datadoghq.com` (US1) | `https://api.datadoghq.com/api/v2/scim` |
| `us3.datadoghq.com` | `https://api.us3.datadoghq.com/api/v2/scim` |
| `us5.datadoghq.com` | `https://api.us5.datadoghq.com/api/v2/scim` |
| `app.datadoghq.eu` (EU) | `https://api.datadoghq.eu/api/v2/scim` |
| `ap1.datadoghq.com` | `https://api.ap1.datadoghq.com/api/v2/scim` |
| `ap2.datadoghq.com` | `https://api.ap2.datadoghq.com/api/v2/scim` |
| `uk1.datadoghq.com` | `https://api.uk1.datadoghq.com/api/v2/scim` |

1. Open **Connections → New connection** and choose **Datadog**.
2. The base URL is filled in for US1. On another site, replace it with your site's URL from the table.
3. Paste the application key and click **Test connection**.
4. Choose who gets Datadog: tick the Google groups or organizational units, for example engineering and SRE. Leave **Push group membership** off unless Datadog support has turned on SCIM provisioning for Teams in your organization.
5. Check the dry-run and click **Activate connection**.

## Good to know

- **Roles:** new users get your organization's default role, if one is set. Change roles in Datadog.
- **SAML:** SSO is recommended but not required. If you use SAML, turn off SAML just-in-time provisioning, so only SCIM creates users.
- **Leavers:** when a Google user is suspended, AnySCIM sends `active: false` and Datadog disables the user.

## Troubleshooting

- **401 or 403 on every request:** the key was revoked, or the service account's role lacks `user_access_invite` and `user_access_manage`.
- **404 on every request:** the base URL uses the app host (`app.datadoghq.com`) or the wrong site. Use the API host from the table above.
- **Errors on groups:** SCIM provisioning for Teams isn't enabled for your organization. Turn off **Push group membership**, or ask Datadog support to enable it.

## FAQ

### Which Datadog plans support SCIM?

Infrastructure Pro and Infrastructure Enterprise. Datadog documents connectors for Microsoft Entra ID and Okta, and its SCIM API works with other SCIM clients such as AnySCIM.

### Which key does Datadog SCIM use?

A Datadog application key, ideally from a service account whose role has the `user_access_invite` and `user_access_manage` permissions. AnySCIM sends it as the bearer token.

### Can Google groups become Datadog Teams?

Only if Datadog has enabled SCIM provisioning for Teams in your organization; it's available on request from Datadog support. Until then, leave **Push group membership** off and manage teams in Datadog.