Keeper SCIM provisioning (users and teams) from Google Workspace

Keeper accepts SCIM provisioning for users and teams on a node in the Keeper Admin Console. Google Workspace's built-in auto-provisioning for Keeper creates users but doesn't push groups: Keeper's documentation notes that Google doesn't support group provisioning to Keeper teams. AnySCIM sends both, so Google groups become Keeper teams and people who leave get their vault locked.

Requirements

• A Keeper business account and access to the Keeper Admin Console.
• The node your Google Workspace users belong to. If you use Keeper SSO Connect, use the SSO-enabled node, not the root node.
• A Google Workspace source already connected. See Connect Google Workspace.

Create the Keeper provisioning token

1. In the Keeper Admin Console, select the node and open the Provisioning tab.
2. Click Add Method, select SCIM and click Next.
3. Click Create Provisioning Token.
4. Copy the URL and the Token shown on the next screen, then click Save. Keeper warns that provisioning fails if you don't save both values and the method.

Connect Keeper in AnySCIM

1. Open Connections → New connection and choose Keeper.
2. Paste the URL and the Token from Keeper, then click Test connection.
3. In Scope, select the people who should have Keeper. Turn on Push group membership to create Keeper teams from Google groups.
4. Review the dry-run and activate. The SCIM method in Keeper changes from Pending to active after the first sync.

How users are synced

• New users in scope are added to the node and receive an email invitation to set up their Keeper vault.
• Google groups become Keeper teams, with nested Google groups expanded. Keeper puts new SCIM teams in a pending queue, and they're created once approved through one of Keeper's team approval methods.
• When a Google user is suspended, AnySCIM sets active: false and Keeper locks the account. The vault isn't deleted.
• Users found in Keeper but no longer in scope are left alone by default. In Settings → When a user is deleted you can choose to deactivate them instead.

Troubleshooting

• Teams don't appear in Keeper: they're waiting in the pending queue. Approve them with one of Keeper's team approval methods.
• Users are asked for a master password instead of SSO: they're in the root node. Move them to the SSO-enabled node; an admin can't move their own account, so ask another admin.
• 401 on every request: a new provisioning token was generated for the SCIM method. Paste it into the connection.

FAQ

Does Google Workspace provision Keeper teams?

No. Google's built-in Keeper provisioning creates and locks users but doesn't push groups to Keeper teams. AnySCIM sends Google groups as SCIM groups, which Keeper turns into teams.

What happens to a Keeper vault when someone leaves?

When their Google account is suspended, AnySCIM sends active: false and Keeper locks the account. The account and its vault aren't deleted.

Do I need Keeper SSO Connect for SCIM?

No. Keeper supports SCIM on its own or together with SSO. With SSO, provision users into the SSO-enabled node.