# Sentry SCIM provisioning from Google Workspace

> Add and remove Sentry organization members and teams from Google Workspace with Sentry SCIM on the Business or Enterprise plan. Token and AnySCIM setup.

**Sentry supports SCIM on the Business and Enterprise plans.** When you enable SCIM in your organization's auth settings, Sentry shows a SCIM base URL and an auth token. AnySCIM uses them with `https://sentry.io/api/0/organizations/{organization_slug}/scim/v2` to add people from Google Workspace as organization members, turn Google groups into Sentry teams and remove people who leave.

## Requirements

- A Sentry **Business** or **Enterprise** plan. SCIM is not available on trials.
- **SAML SSO** configured for the organization. Google Workspace can be the SAML identity provider through a custom SAML app.
- A Sentry user who can edit the organization's **auth settings**.

## Enable SCIM in Sentry

1. In Sentry, go to **Settings → Auth** for your organization.
2. Under **General Settings**, select **Enable SCIM** and click **Save Settings**.
3. Sentry now shows **SCIM Information** with the **SCIM Base URL** and the **Auth Token**. Copy both.

> **Tip:** copy the base URL exactly as Sentry shows it rather than typing it, because it contains your organization slug. If you ever rename the organization slug, update the URL in AnySCIM too.

## Connect Sentry in AnySCIM

1. Open **Connections → New connection** and choose **Sentry**.
2. Replace the pre-filled base URL with the **SCIM Base URL** from Sentry, paste the **Auth Token** and click **Test connection**.
3. In **Scope**, select the people who should be Sentry members, for example your engineering groups. Turn on **Push group membership** to create a Sentry team for each Google group.
4. Review the dry-run and activate.

## How users are synced

- New users in scope are added to the Sentry organization, matched by email (`userName`).
- New members get the default organization role set in **Settings → Auth**. AnySCIM doesn't send Sentry's `sentryOrgRole` attribute, so change roles in Sentry, and keep in mind that the **Owner** role can't be assigned through SCIM.
- Google groups become Sentry teams. Sentry lowercases team names and replaces spaces with dashes, so `Platform Team` becomes `platform-team`.
- When a Google user is suspended, AnySCIM sets `active: false`. Sentry treats this as removal and deletes the organization membership; the person's Sentry account itself remains.

## Troubleshooting

- **First and last names show as "N/A":** Sentry's SCIM API doesn't store `name.givenName` or `name.familyName`. This is expected.
- **Can't change a member in Sentry:** members and team memberships managed by SCIM can only be changed from the identity provider. Change the Google group, or take the user out of scope.
- **Requests fail after renaming the organization:** the base URL contains the slug. Copy the new URL from **Settings → Auth** into the connection.

## FAQ

### Which Sentry plans support SCIM?

Business and Enterprise. Sentry doesn't offer SCIM on Developer, Team or trial plans.

### Can AnySCIM create Sentry teams from Google groups?

Yes. Enable **Push group membership** in the connection scope: each Google group becomes a Sentry team, and nested Google groups are expanded so the team contains every effective member.

### What happens to a Sentry user when they leave the company?

When their Google account is suspended, AnySCIM sends `active: false` and Sentry removes their membership from your organization at the next sync. Their Sentry user account isn't deleted.