Salesforce SCIM provisioning from Google Workspace
Provision Salesforce users from Google Workspace with the Salesforce SCIM API: connected app, OAuth token, unique usernames and AnySCIM setup.
- SCIM base URL
https://{instance}.my.salesforce.com/services/scim/v2- Vendor plan
- Salesforce editions with API access (Enterprise, Unlimited, Performance)
- Authentication
- OAuth access token from a connected app with the api scope
- Provisions
- Users, deactivation
Salesforce exposes a SCIM 2.0 API at https://{your-domain}.my.salesforce.com/services/scim/v2. AnySCIM authenticates with an OAuth access token from a connected app and creates, updates and deactivates Salesforce users from Google Workspace. Salesforce tokens follow your org's session timeout, so plan to replace the token when it expires.
Requirements
- A Salesforce edition with API access.
- A connected app (or external client app) with the
apiOAuth scope. - An integration user with the Manage Users permission. Its profile determines what the SCIM API can do.
- Your My Domain name, for example
acmeinacme.my.salesforce.com.
Create the connected app
- In Setup, open App Manager and create a new connected app.
- Enable OAuth settings and add the
apiscope. - Enable the Client Credentials Flow and set the integration user as the *Run As* user.
- Copy the consumer key and consumer secret, then request an access token with the client credentials grant from
https://{your-domain}.my.salesforce.com/services/oauth2/token.
Connect Salesforce in AnySCIM
In Connections → New connection, choose Salesforce, replace {instance} with your My Domain and paste the access token.
How users are synced
- Salesforce usernames must be unique across every Salesforce org in the world, sandboxes included. AnySCIM uses the Google primary email as
userName, which works for production orgs on your own domain. - Profile changes are pushed with
PATCH. - A suspended Google user is sent as
active: false, which deactivates the Salesforce user and frees the license. Salesforce does not allow deleting users. - New users get the default profile configured for SCIM in your org. Check which profile that is before the first sync.
Troubleshooting
- 401
INVALID_SESSION_ID: the access token expired. Request a new one from the connected app. DUPLICATE_USERNAME: the username is already taken in another org, often a sandbox. Rename the user in the sandbox, or provision that user manually.- 403: the integration user lacks Manage Users, or the connected app is not approved for it.
FAQ
Does Salesforce support SCIM 2.0?
Yes. Salesforce provides a SCIM 2.0 endpoint under /services/scim/v2 on your My Domain.
Why does the token stop working after a few hours?
Salesforce access tokens follow the session timeout. AnySCIM doesn't renew the token yet, so when it expires you need to request a new one from the connected app.
Can AnySCIM delete Salesforce users?
No, and neither can any tool: Salesforce users can only be deactivated. AnySCIM sets active: false.
Try it on your own directory
Connect Google Workspace and preview the first sync in dry-run: nothing is sent until you activate the connection.
