SCIM setup — Google Workspace

Google Workspace is a community-tier vendor: provisioning is supported for users via the standard SCIM endpoints, but Google Workspace does NOT push Groups via SCIM (it uses the Directory API). Group sync is tracked as a post-GA follow-on (see add-scim-google-directory-api in openspec/changes/).

Prereqs

• MOD tenant with SCIM enabled.
• Google Workspace super-admin or Identity and Access Management admin.
• A SCIM bearer token from MOD Dashboard → Admin → SCIM tab.

Steps

1. Add MOD as a SAML + SCIM app

1. admin.google.com → Apps → Web and mobile apps → Add app → Add custom SAML app.
2. App name: MOD.
3. Continue.
4. Skip the SAML config (you can set it up later for SSO; that's add-self-service-sso, not SCIM).
5. Save.

2. Enable auto-provisioning

1. The MOD app → "Auto-provisioning" → Configure auto-provisioning.
2. SCIM endpoint URL: https://api.modtechlabs.com/scim/v2
3. SCIM token: the plaintext bearer from MOD's modal.
4. Continue.
5. Expected: "MOD verified" green check.

3. Attribute mapping

Google's default mapping covers MOD's required fields. The notable mappings:

Google attribute	MOD attribute
primaryEmail	userName + emails[primary]
name.givenName	name.givenName
name.familyName	name.familyName
externalIds (custom)	externalId

4. Activate

1. Activate the integration.
2. Assign Google users to MOD via the standard Google Workspace "Apps → SAML app → Service Status" flow.

Known behaviours

From the vendor compat matrix:

• No Groups via SCIM — Google emits user-only events. For role-via-group, customers either (a) sign up for the add-scim-google-directory-api post-GA feature, or (b) assign roles in MOD via the manual permission templates.

Troubleshooting

symptom	likely cause	fix
Provisioning shows "verification failed"	Bearer rotated/revoked in MOD	Regenerate + paste
Users provision but no Groups	Expected — Google doesn't push Groups via SCIM	Wait for the post-GA Directory API integration

Screenshots

See CORE/docs-site/docs/assets/scim-google-workspace-*.png.