Miro SCIM provisioning from Google Workspace

Miro supports SCIM provisioning on the Enterprise plan, once SSO/SAML is enabled. You generate a SCIM token in Miro's company settings, and AnySCIM uses it with https://miro.com/api/v1/scim to create Miro accounts for people in Google Workspace, sync Google groups to Miro user groups and deactivate people who leave.

Requirements

• A Miro Enterprise plan.
• SSO/SAML enabled in Miro. Google Workspace can be the SAML identity provider through a custom SAML app.
• A Miro admin with access to Company settings, to generate the token.
• A Google Workspace source already connected. See Connect Google Workspace.

Generate the Miro SCIM token

1. In Miro, open Company settings → Enterprise integrations and check that SSO/SAML is enabled.
2. In the SCIM Provisioning section, click Generate new token, then Generate.
3. Copy the token. It grants access to every account in your Miro company, so store it like a password.

Connect Miro in AnySCIM

1. Open Connections → New connection and choose Miro.
2. The base URL is pre-filled with https://miro.com/api/v1/scim. Paste the token and click Test connection.
3. In Scope, select the groups or organizational units that should have Miro. Turn on Push group membership to create Miro user groups from Google groups.
4. Review the dry-run, then click Activate connection.

How users are synced

• New users in scope get a Miro account, matched by email. Miro uses the email address as the SCIM userName.
• Name, title and department changes are pushed with PATCH.
• A suspended Google user is set to active: false, which makes the Miro account inactive instead of deleting it.
• Google groups become Miro user groups. Assign a user group to a Miro team and its members join the team, so team access follows your Google groups.
• Users found in Miro but no longer in scope are left alone by default. In Settings → When a user is deleted you can choose to deactivate or delete them instead.

Troubleshooting

• 401 on every request: the token was regenerated or revoked. Paste the current token into the connection.
• Test fails before SSO is set up: Miro only offers SCIM once SSO/SAML is enabled. Finish the SSO setup first.
• A user can't sign in after being provisioned: check that the Google Workspace email AnySCIM sends as userName is the same email your SAML app sends at sign-in.

FAQ

Which Miro plan supports SCIM?

The Enterprise plan. SCIM is configured in Company settings → Enterprise integrations and requires SSO/SAML to be enabled first.

Does deactivating a user in Google delete them from Miro?

No. AnySCIM sends active: false, which deactivates the Miro account. Deletion only happens if you choose Delete for users removed from the scope.

Can Google groups manage Miro team membership?

Yes. With Push group membership enabled, each Google group becomes a Miro user group. Assign that user group to a team in Miro and its members are added to the team.