# Slack SCIM provisioning from Google Workspace

> Create, update and deactivate Slack accounts from Google Workspace with the Slack SCIM API: plan requirements, the admin token and AnySCIM setup.

**To provision Slack from Google Workspace you need a Slack Business+ or Enterprise Grid plan and an OAuth token with the `admin` scope, installed by an Owner.** AnySCIM uses that token to call the Slack SCIM API at `https://api.slack.com/scim/v2`, creating accounts for new hires, keeping profiles in sync and deactivating people who leave.

## Requirements

- A Slack plan that includes the SCIM API: **Business+** or **Enterprise Grid**.
- A **Workspace Primary Owner** (Business+) or **Org Owner** (Enterprise Grid) to install the app that issues the token.
- A Google Workspace source already connected. See [Connect Google Workspace](/docs/google-workspace).

## Get a Slack SCIM token

1. Go to [api.slack.com/apps](https://api.slack.com/apps) and create a new app in your workspace (or organization).
2. Under **OAuth & Permissions → User Token Scopes**, add the `admin` scope.
3. Install the app. The installing user must be an Owner, since the SCIM API acts with their privileges.
4. Copy the **User OAuth Token** (it starts with `xoxp-`). Store it like a password: it can manage every account in Slack.

> **Tip:** install the app from a dedicated owner account rather than a personal one, so the token keeps working when people change roles.

## Connect Slack in AnySCIM

1. Open **Connections → New connection** and choose **Slack**.
2. The base URL is pre-filled with `https://api.slack.com/scim/v2`. Paste the token and click **Test connection**.
3. In **Scope**, pick the groups or organizational units that should have Slack. Turn on **Push group membership** to create Slack user groups from Google groups.
4. Review the dry-run, then click **Activate connection**.

## How users are synced

- New Google users in scope get a Slack account, matched by email (`userName`).
- Name, title and department changes are pushed with `PATCH`.
- A suspended Google user is set to `active: false`, which deactivates the Slack account. Slack keeps the account and its message history; it is not deleted.
- Users found in Slack but no longer in scope are left alone by default. In **Settings → When a user is deleted** you can choose to deactivate them instead; this applies to every Slack account outside the scope, including ones AnySCIM did not create.

## Troubleshooting

- **401 `invalid_authentication`:** the token was revoked or the app was uninstalled. Reinstall it and update the connection.
- **403 on every request:** the plan does not include SCIM, or the token lacks the `admin` scope.
- **Owners cannot be deactivated:** Slack refuses SCIM deactivation of the Primary Owner. Exclude that account from the scope.
- **429 rate limited:** Slack limits SCIM calls per minute. AnySCIM backs off and retries using `Retry-After`; large first syncs simply take longer.

## FAQ

### Which Slack plans support SCIM provisioning?

Business+ and Enterprise Grid. The Free and Pro plans do not expose the SCIM API.

### Does deactivating a user in Google delete them from Slack?

No. AnySCIM sends `active: false`, which deactivates the Slack account and frees the seat while keeping the user's messages and files.

### Can I sync Google groups to Slack user groups?

Yes. Enable **Push group membership** in the connection scope. Nested Google groups are expanded, so the Slack user group contains every effective member.