# Notion SCIM provisioning from Google Workspace

> Add and remove Notion workspace members automatically from Google Workspace with Notion SCIM on the Enterprise plan. Token, groups and AnySCIM setup.

**Notion supports SCIM provisioning on the Enterprise plan.** A workspace owner generates a SCIM token in Notion's settings, and AnySCIM uses it with `https://api.notion.com/scim/v2` to add members from Google Workspace, keep their profiles up to date, sync groups and remove people who leave.

## Requirements

- A **Notion Enterprise** workspace.
- A **workspace owner** to generate the token.
- Members' emails on your Google Workspace domain.

## Generate the SCIM token

1. In Notion, open **Settings** and go to **Identity & provisioning** (on some workspaces the section is called **Security & identity**).
2. Under **SCIM provisioning**, generate a new token.
3. Copy it now. The token is tied to the owner who created it: if that person stops being an owner, generate a new one.

## Connect Notion in AnySCIM

1. Open **Connections → New connection** and choose **Notion**.
2. The base URL is pre-filled with `https://api.notion.com/scim/v2`. Paste the token and click **Test connection**.
3. In **Scope**, select who should be a Notion member. Turn on **Push group membership** to create Notion groups, which you can then use to share teamspaces and pages.
4. Review the dry-run and activate.

## How users are synced

- New users in scope are added as workspace members, matched by email.
- Name changes are pushed with `PATCH`.
- When a Google user is suspended, AnySCIM sets `active: false` and Notion removes the member from the workspace.
- Pages owned by a removed member stay in the workspace.

## FAQ

### Which Notion plan supports SCIM?

Only Enterprise. On other plans, members have to be invited and removed manually or through email domain settings.

### Can Notion groups be managed from Google groups?

Yes. With **Push group membership** enabled, Google groups become Notion groups and their membership is kept in sync.

### What happens if the owner who created the token leaves?

The token stops working. Generate a new token from another owner account and update the connection in AnySCIM.