Streamline identity lifecycle management in Google Workspace

Streamline identity lifecycle management in Google Workspace with new inbound SCIM support

We are excited to announce the general availability of Google Workspace inbound SCIM APIs to help IT administrators standardize identity lifecycle management. This new capability allows you to sync your Google Workspace directory in real time with any SCIM-compatible Identity Provider (IdP), HR system (HRIS), or custom application.

With inbound SCIM, when a Workspace end user’s account permissions are changed via their organization’s IdP, their access to Workspace data and any downstream apps, such as Gemini Enterprise, will also be updated in real time. Previously, customers would need to build custom integrations using Google directory APIs.

SCIM overview

System for Cross-domain Identity Management (SCIM) is an open protocol that synchronizes directory information between identity systems. With inbound SCIM, Google Workspace acts as a SCIM Service Provider, enabling compatible Identity Providers (IdPs) to automatically provision, update, and deactivate users and groups in real time.

Inbound SCIM offers:

Automated lifecycle management: IT teams no longer need to manually create user accounts or update details for Workspace, saving significant time and costs.
Seamless onboarding and day-one productivity: New employees have access to all Workspace productivity tools the moment they start, creating a frictionless onboarding experience.
Enhanced security with instant deprovisioning: When an employee leaves your organization or changes roles, SCIM instantly pushes an update request to Workspace. This eliminates the security risks associated with orphaned accounts and makes compliance audits significantly easier.
Simplified admin experience: Inbound SCIM offers a one-click token generation experience and admin controls to lock synced groups from your external source to prevent manual changes in Workspace that would conflict with your identity provider.

Getting started

Admins: This feature will be available by default and can be disabled/enabled at the domain level. Visit the Help Center to learn more.
End users: This is an admin-facing feature only.

Streamline identity lifecycle management in Google Workspace with new inbound SCIM support

The Manage external directories page in the Admin console showing Inbound SCIM setup

Configure a new Inbound SCIM connection with external IdP

Rollout pace

Rapid Release and Scheduled Release domains: Gradual rollout (up to 15 days for feature visibility) starting July 9, 2026

Availability

Business: Business Starter, Standard, and Plus
Enterprise: Enterprise Starter, Standard, and Plus

Resources

Google Workspace Admin Help: Get started with Inbound SCIM

Google Workspace has announced the general availability of inbound SCIM APIs, allowing IT administrators to synchronize their Google Workspace directory in real time with any SCIM-compatible Identity Provider (IdP), HR system (HRIS), or custom application. [1]

This native support eliminates the need to build and maintain complex, custom integrations using Google Directory APIs. When a user’s account or permissions change in your primary external IdP, those updates immediately propagate down to Workspace and downstream apps like Gemini Enterprise. [1]

Key Benefits of Inbound SCIM Support

The SCIM protocol streamlines IT operations, offering several key advantages: [1, 2]

Automated Lifecycle Management: Eliminates manual creation, updates, and deletion of user profiles in the Google Admin console.
Instant Onboarding: New employees receive immediate access to assigned Workspace tools upon HR system activation.
Real-Time Security: Instantly revokes access for offboarded employees, mitigating security risks from orphaned accounts and simplifying audits.
Simplified Administration: Includes a token generation wizard and controls to prevent conflicts between the IdP and Workspace. [1]

Streamlining Workflows

Inbound SCIM replaces manual CSV imports or custom APIs with a direct, standardized connection to your identity provider (e.g., Okta, Microsoft Entra ID). This ensures user state changes are instantly reflected across Google Workspace. [1, 2, 3]

To get started, evaluate your current IdP/HR system, the process for generating the SCIM token, and the retirement of existing custom API scripts. [1]