# New Relic SCIM provisioning from Google Workspace

> Provision New Relic users and groups from Google Workspace with New Relic's SCIM API on Pro or Enterprise. Authentication domain, token and AnySCIM setup.

**New Relic supports automated user management with SCIM on the Pro and Enterprise editions.** You set an authentication domain's source of users to SCIM, and New Relic shows an API access token once. AnySCIM uses it with `https://scim-provisioning.service.newrelic.com/scim/v2` to create New Relic users from Google Workspace, import Google groups and deactivate people who leave.

## Requirements

- New Relic **Pro** or **Enterprise** edition.
- **SAML SSO** for the authentication domain. Google Workspace can be the identity provider through a custom SAML app.
- A New Relic user with a core or full platform user type, in a group with the **Authentication domain manager** role.

> **Before you start:** once an authentication domain uses SCIM, you manage its users and groups only through SCIM, not in the New Relic UI, and the domain can't be switched back. Create a dedicated authentication domain for Google Workspace users if you're testing.

## Get the New Relic SCIM token

1. In New Relic, open **Administration → Authentication domains** and create or select the domain for your Google Workspace users.
2. Under **Source of users**, select **SCIM** and save.
3. Copy the **API access token**. New Relic shows it only once: if you lose it, generate a new one, which invalidates the old token.

The token doesn't expire.

## Connect New Relic in AnySCIM

1. Open **Connections → New connection** and choose **New Relic**.
2. The base URL is pre-filled with `https://scim-provisioning.service.newrelic.com/scim/v2`. Paste the token and click **Test connection**.
3. In **Scope**, select the people who should have New Relic. Turn on **Push group membership** to import Google groups into New Relic.
4. Review the dry-run and activate.
5. In New Relic, open **Access management** and grant each imported group its roles and accounts. Until you do, provisioned users can sign in but have no access to any account.

## How users are synced

- New users in scope are created in the authentication domain, with their Google email as `userName`. Name and title changes are pushed with `PATCH`.
- New users start as **Basic** users. AnySCIM doesn't send New Relic's `nrUserType` attribute, so upgrade users to Core or Full in New Relic's user management.
- Google groups become New Relic groups, with nested Google groups expanded. Roles and account access are granted to groups in New Relic, so access follows Google group membership.
- When a Google user is suspended, AnySCIM sets `active: false` and the user is deactivated in New Relic.

## Troubleshooting

- **Users have no access after provisioning:** their groups don't have roles yet. Grant them in **Access management**.
- **409 "Resource already exists":** a user or group with the same name already exists in the authentication domain. Remove the duplicate in New Relic, or exclude it from the scope.
- **401 on every request:** the token was regenerated. Paste the new one into the connection.

## FAQ

### Which New Relic editions support SCIM?

Pro and Enterprise. Automated user management isn't available on the Free or Standard editions.

### Does New Relic SCIM work with Google Workspace?

Yes. New Relic ships apps for Okta, Microsoft Entra ID and OneLogin, and documents its SCIM API for any other identity provider. AnySCIM connects Google Workspace to that API.

### Can Google groups control New Relic roles?

Yes, in two steps. AnySCIM keeps New Relic group membership in sync with Google groups, and you grant each group its roles and accounts once in **Access management**.