# Keeper SCIM provisioning (users and teams) from Google Workspace

> Provision Keeper users and sync Google groups to Keeper teams with SCIM, which Google's built-in Keeper provisioning can't do. Token, nodes and AnySCIM setup.

**Keeper accepts SCIM provisioning for users and teams on a node in the Keeper Admin Console.** Google Workspace's built-in auto-provisioning for Keeper creates users but doesn't push groups: Keeper's documentation notes that Google doesn't support group provisioning to Keeper teams. AnySCIM sends both, so Google groups become Keeper teams and people who leave get their vault locked.

## Requirements

- A Keeper business account and access to the **Keeper Admin Console**.
- The **node** your Google Workspace users belong to. If you use Keeper SSO Connect, use the SSO-enabled node, not the root node.
- A Google Workspace source already connected. See [Connect Google Workspace](/docs/google-workspace).

> **Using Google's built-in provisioning?** Turn off auto-provisioning in the Keeper app in the Google Admin console before connecting AnySCIM, so only one system manages Keeper users.

## Create the Keeper provisioning token

1. In the Keeper Admin Console, select the node and open the **Provisioning** tab.
2. Click **Add Method**, select **SCIM** and click **Next**.
3. Click **Create Provisioning Token**.
4. Copy the **URL** and the **Token** shown on the next screen, then click **Save**. Keeper warns that provisioning fails if you don't save both values and the method.

## Connect Keeper in AnySCIM

1. Open **Connections → New connection** and choose **Keeper**.
2. Paste the **URL** and the **Token** from Keeper, then click **Test connection**.
3. In **Scope**, select the people who should have Keeper. Turn on **Push group membership** to create Keeper teams from Google groups.
4. Review the dry-run and activate. The SCIM method in Keeper changes from **Pending** to active after the first sync.

## How users are synced

- New users in scope are added to the node and receive an email invitation to set up their Keeper vault.
- Google groups become Keeper teams, with nested Google groups expanded. Keeper puts new SCIM teams in a **pending queue**, and they're created once approved through one of Keeper's team approval methods.
- When a Google user is suspended, AnySCIM sets `active: false` and Keeper **locks** the account. The vault isn't deleted.
- Users found in Keeper but no longer in scope are left alone by default. In **Settings → When a user is deleted** you can choose to deactivate them instead.

## Troubleshooting

- **Teams don't appear in Keeper:** they're waiting in the pending queue. Approve them with one of Keeper's team approval methods.
- **Users are asked for a master password instead of SSO:** they're in the root node. Move them to the SSO-enabled node; an admin can't move their own account, so ask another admin.
- **401 on every request:** a new provisioning token was generated for the SCIM method. Paste it into the connection.

## FAQ

### Does Google Workspace provision Keeper teams?

No. Google's built-in Keeper provisioning creates and locks users but doesn't push groups to Keeper teams. AnySCIM sends Google groups as SCIM groups, which Keeper turns into teams.

### What happens to a Keeper vault when someone leaves?

When their Google account is suspended, AnySCIM sends `active: false` and Keeper locks the account. The account and its vault aren't deleted.

### Do I need Keeper SSO Connect for SCIM?

No. Keeper supports SCIM on its own or together with SSO. With SSO, provision users into the SSO-enabled node.