Slack SCIM provisioning from Google Workspace

To provision Slack from Google Workspace you need a Slack Business+ or Enterprise Grid plan and an OAuth token with the admin scope, installed by an Owner. AnySCIM uses that token to call the Slack SCIM API at https://api.slack.com/scim/v2, creating accounts for new hires, keeping profiles in sync and deactivating people who leave.

Requirements

• A Slack plan that includes the SCIM API: Business+ or Enterprise Grid.
• A Workspace Primary Owner (Business+) or Org Owner (Enterprise Grid) to install the app that issues the token.
• A Google Workspace source already connected. See Connect Google Workspace.

Get a Slack SCIM token

1. Go to api.slack.com/apps and create a new app in your workspace (or organization).
2. Under OAuth & Permissions → User Token Scopes, add the admin scope.
3. Install the app. The installing user must be an Owner, since the SCIM API acts with their privileges.
4. Copy the User OAuth Token (it starts with xoxp-). Store it like a password: it can manage every account in Slack.

Connect Slack in AnySCIM

1. Open Connections → New connection and choose Slack.
2. The base URL is pre-filled with https://api.slack.com/scim/v2. Paste the token and click Test connection.
3. In Scope, pick the groups or organizational units that should have Slack. Turn on Push group membership to create Slack user groups from Google groups.
4. Review the dry-run, then click Activate connection.

How users are synced

• New Google users in scope get a Slack account, matched by email (userName).
• Name, title and department changes are pushed with PATCH.
• A suspended Google user is set to active: false, which deactivates the Slack account. Slack keeps the account and its message history; it is not deleted.
• Users found in Slack but no longer in scope are left alone by default. In Settings → When a user is deleted you can choose to deactivate them instead; this applies to every Slack account outside the scope, including ones AnySCIM did not create.

Troubleshooting

• 401 invalid_authentication: the token was revoked or the app was uninstalled. Reinstall it and update the connection.
• 403 on every request: the plan does not include SCIM, or the token lacks the admin scope.
• Owners cannot be deactivated: Slack refuses SCIM deactivation of the Primary Owner. Exclude that account from the scope.
• 429 rate limited: Slack limits SCIM calls per minute. AnySCIM backs off and retries using Retry-After; large first syncs simply take longer.

FAQ

Which Slack plans support SCIM provisioning?

Business+ and Enterprise Grid. The Free and Pro plans do not expose the SCIM API.

Does deactivating a user in Google delete them from Slack?

No. AnySCIM sends active: false, which deactivates the Slack account and frees the seat while keeping the user's messages and files.

Can I sync Google groups to Slack user groups?

Yes. Enable Push group membership in the connection scope. Nested Google groups are expanded, so the Slack user group contains every effective member.