# Snowflake SCIM provisioning from Google Workspace

> Provision Snowflake users and roles from Google Workspace with a custom SCIM integration: the security integration SQL, the SCIM token and AnySCIM setup.

**Snowflake ships SCIM connectors for Okta and Microsoft Entra ID, and a custom SCIM integration for every other identity provider, including Google Workspace through AnySCIM.** You create the integration with a few SQL statements, generate a SCIM access token, and AnySCIM uses it with `https://{account_identifier}.snowflakecomputing.com/scim/v2` to create Snowflake users, sync Google groups as Snowflake roles and disable people who leave.

## Requirements

- The **ACCOUNTADMIN** role in Snowflake, to create the integration and the provisioning role.
- Your **account identifier**, the first part of your Snowflake URL (`<account_identifier>.snowflakecomputing.com`). If it contains underscores, use the hyphenated form.
- A Google Workspace source already connected. See [Connect Google Workspace](/docs/google-workspace).

## Create the SCIM integration and token

Run these statements in a worksheet:

```sql
use role accountadmin;

create role if not exists generic_scim_provisioner;
grant create user on account to role generic_scim_provisioner;
grant create role on account to role generic_scim_provisioner;
grant role generic_scim_provisioner to role accountadmin;

create or replace security integration generic_scim_provisioning
  type = scim
  scim_client = 'generic'
  run_as_role = 'GENERIC_SCIM_PROVISIONER';

select system$generate_scim_access_token('GENERIC_SCIM_PROVISIONING');
```

Copy the value returned by the last statement. Users and roles created through SCIM are owned by `GENERIC_SCIM_PROVISIONER`.

> **Token expiry:** the SCIM access token is valid for **six months**. Set a reminder to run `system$generate_scim_access_token` again before it expires and paste the new token into the connection. Running `drop integration` invalidates the token immediately.

## Connect Snowflake in AnySCIM

1. Open **Connections → New connection** and choose **Snowflake**.
2. Replace `{account_identifier}` in the base URL with your account identifier, paste the token and click **Test connection**.
3. In **Scope**, select the people who should have Snowflake, for example your data and analytics groups. Turn on **Push group membership** to create a Snowflake role for each Google group.
4. Review the dry-run and activate.

## How users are synced

- New users in scope are created in Snowflake with their Google email as the user name and login name, and their full name as the display name.
- AnySCIM looks users up with `userName eq`, the only filter Snowflake's SCIM API supports.
- When a Google user is suspended, AnySCIM sets `active: false`, which sets `DISABLED = TRUE` on the Snowflake user.
- Each Google group becomes a Snowflake role with the same name, and its members are granted that role. Nested Google groups are expanded first. Grant privileges to these roles in Snowflake as usual: AnySCIM manages who has the role, not what the role can do.
- AnySCIM doesn't send passwords. Users sign in through SSO, which you enable separately in Snowflake.

## Troubleshooting

- **401 after months of working:** the six-month token expired. Generate a new one and update the connection.
- **Errors when changing roles:** the provisioning role must own the roles it manages. Don't change the owner of SCIM-created roles, or use a role with `MANAGE GRANTS` as `run_as_role`.
- **Requests blocked by a network policy:** a network policy set on the SCIM integration overrides the account-level one. Set one with `alter security integration generic_scim_provisioning set network_policy = <policy>` that allows AnySCIM's servers.
- **Changes made in Snowflake are overwritten:** edits made directly in Snowflake are not synced back to Google Workspace. Make changes in Google and let the next sync apply them.

## FAQ

### Does Snowflake support SCIM with Google Workspace?

Snowflake has no built-in Google Workspace connector, but its custom SCIM integration (`scim_client = 'generic'`) works with any SCIM client. AnySCIM connects Google Workspace to it.

### Do Google groups become Snowflake roles?

Yes. With **Push group membership** enabled, each Google group becomes a Snowflake role of the same name and its members are granted it. You then grant privileges to that role in Snowflake.

### How long does the Snowflake SCIM token last?

Six months. Generate a new one with `system$generate_scim_access_token('GENERIC_SCIM_PROVISIONING')` and update the AnySCIM connection before it expires.