# GitHub Enterprise SCIM provisioning from Google Workspace

> Provision GitHub Enterprise Managed Users from Google Workspace with the GitHub SCIM API: requirements, the scim:enterprise token and setup.

**GitHub accepts SCIM provisioning for enterprises that use Enterprise Managed Users (EMU).** In an EMU enterprise, accounts are created and controlled by your identity provider. AnySCIM fills that role for Google Workspace, calling `https://api.github.com/scim/v2/enterprises/{enterprise}` with a token that has the `scim:enterprise` scope.

## Requirements

- **GitHub Enterprise Cloud** with **Enterprise Managed Users**. Regular personal accounts and organizations without EMU cannot be provisioned with SCIM from AnySCIM.
- SAML or OIDC single sign-on configured for the enterprise, so provisioned users can sign in.
- Access to the enterprise **setup user** (the account ending in `_admin`, created when the enterprise was set up).
- Your **enterprise slug**, the name in `github.com/enterprises/<slug>`.

## Create the token

1. Sign in as the setup user.
2. Create a **personal access token (classic)** with the `scim:enterprise` scope. Give it no expiration, or put a reminder in your calendar to rotate it before it expires.
3. Copy the token.

> **Note:** check GitHub's documentation on provisioning users for Enterprise Managed Users, including the options for identity systems other than the partner IdPs, before going live.

## Connect GitHub in AnySCIM

1. Open **Connections → New connection** and choose **GitHub**.
2. Replace `{enterprise}` in the base URL with your enterprise slug, for example `https://api.github.com/scim/v2/enterprises/acme`.
3. Paste the token and click **Test connection**.
4. In **Scope**, select only the groups that need GitHub access, typically your engineering groups. Turn on **Push group membership** if you want to link the groups to GitHub teams.
5. Review the dry-run and activate.

## How users are synced

- Each provisioned user becomes a managed user. GitHub derives the handle from the user's identity and appends your enterprise short code (for example `giulia-ferri_acme`).
- Profile changes are pushed with `PATCH`.
- A suspended Google user is sent as `active: false`, which suspends the managed user on GitHub and removes their access.
- Groups pushed by AnySCIM appear in the enterprise and can be connected to teams in each organization.

## Troubleshooting

- **401 or 403:** the token is not from the setup user, lacks `scim:enterprise`, or has expired.
- **404:** the enterprise slug in the base URL is wrong.
- **Users created but cannot sign in:** SSO is not configured, or the identity in SSO does not match the provisioned `userName`.

## FAQ

### Can I use SCIM with GitHub Team or a non-EMU enterprise?

Not from AnySCIM. GitHub's SCIM API for user lifecycle management is built for Enterprise Managed Users. Other plans manage membership through invitations or SAML.

### Which token does GitHub require?

A personal access token (classic) created by the enterprise setup user, with the `scim:enterprise` scope.

### Does suspending a user in Google remove them from GitHub?

Yes. The managed user is suspended at the next sync, which removes access to every organization and repository in the enterprise.