# Salesforce SCIM provisioning from Google Workspace

> Provision Salesforce users from Google Workspace with the Salesforce SCIM API: connected app, OAuth token, unique usernames and AnySCIM setup.

**Salesforce exposes a SCIM 2.0 API at `https://{your-domain}.my.salesforce.com/services/scim/v2`.** AnySCIM authenticates with an OAuth access token from a connected app and creates, updates and deactivates Salesforce users from Google Workspace. Salesforce tokens follow your org's session timeout, so plan to replace the token when it expires.

## Requirements

- A Salesforce edition with **API access**.
- A **connected app** (or external client app) with the `api` OAuth scope.
- An integration user with the **Manage Users** permission. Its profile determines what the SCIM API can do.
- Your **My Domain** name, for example `acme` in `acme.my.salesforce.com`.

## Create the connected app

1. In **Setup**, open **App Manager** and create a new connected app.
2. Enable OAuth settings and add the `api` scope.
3. Enable the **Client Credentials Flow** and set the integration user as the *Run As* user.
4. Copy the **consumer key** and **consumer secret**, then request an access token with the client credentials grant from `https://{your-domain}.my.salesforce.com/services/oauth2/token`.

## Connect Salesforce in AnySCIM

In **Connections → New connection**, choose **Salesforce**, replace `{instance}` with your My Domain and paste the access token.

## How users are synced

- Salesforce **usernames must be unique across every Salesforce org in the world**, sandboxes included. AnySCIM uses the Google primary email as `userName`, which works for production orgs on your own domain.
- Profile changes are pushed with `PATCH`.
- A suspended Google user is sent as `active: false`, which deactivates the Salesforce user and frees the license. Salesforce does not allow deleting users.
- New users get the default profile configured for SCIM in your org. Check which profile that is before the first sync.

## Troubleshooting

- **401 `INVALID_SESSION_ID`:** the access token expired. Request a new one from the connected app.
- **`DUPLICATE_USERNAME`:** the username is already taken in another org, often a sandbox. Rename the user in the sandbox, or provision that user manually.
- **403:** the integration user lacks **Manage Users**, or the connected app is not approved for it.

## FAQ

### Does Salesforce support SCIM 2.0?

Yes. Salesforce provides a SCIM 2.0 endpoint under `/services/scim/v2` on your My Domain.

### Why does the token stop working after a few hours?

Salesforce access tokens follow the session timeout. AnySCIM doesn't renew the token yet, so when it expires you need to request a new one from the connected app.

### Can AnySCIM delete Salesforce users?

No, and neither can any tool: Salesforce users can only be deactivated. AnySCIM sets `active: false`.