> ## Documentation Index
> Fetch the complete documentation index at: https://docs.retrac.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Workspace SCIM

> Automatically provision and deprovision Retrac users from Google Workspace.

**SCIM** (System for Cross-domain Identity Management) automatically creates, updates, and deprovisions users in Retrac based on your Google Workspace directory — reducing manual invite management for large teams.

SCIM is available on **Enterprise** plans alongside SAML SSO.

<Note>
  Configure [Google Workspace SAML](/help/article/google-saml) first so provisioned users can sign in. SCIM manages workspace membership; SAML handles authentication.
</Note>

## Prerequisites

* Google Workspace admin access
* Retrac workspace owner role
* Enterprise plan with SCIM enabled
* SAML SSO configured (recommended)

## Set up Google Workspace SCIM

<Steps>
  <Step title="Open Retrac SCIM settings">
    In Retrac, go to **Settings → Security** and open **SCIM** configuration. Generate or copy your:

    * **SCIM endpoint URL**
    * **Bearer token** (shown once — store in a secrets manager)
  </Step>

  <Step title="Enable provisioning in Google">
    In the Google Admin console, open your **Retrac** SAML app (or create a provisioning integration if your Google edition supports automated user provisioning for custom apps).

    Enable **Automatic provisioning** and enter the Retrac SCIM endpoint URL and bearer token when prompted.
  </Step>

  <Step title="Map attributes">
    Map Google directory attributes to Retrac SCIM fields:

    | Google attribute | SCIM field            |
    | ---------------- | --------------------- |
    | Primary email    | `userName` / `emails` |
    | First name       | `name.givenName`      |
    | Last name        | `name.familyName`     |
    | Active status    | `active`              |

    Ensure the email sent by Google matches how users are identified in Retrac.
  </Step>

  <Step title="Assign users or groups">
    Assign the Retrac app to Google users or groups who should be provisioned. Google pushes create, update, and deactivate events to Retrac via SCIM.
  </Step>

  <Step title="Verify provisioning">
    1. Assign a test user in Google.
    2. Confirm they appear under **Settings → Members** in Retrac.
    3. Deactivate the test user in Google and confirm they lose workspace access.

    <Tip>
      Pair SCIM with **location access** — provision users into Retrac, then let owners assign location permissions in **Settings → Members**.
    </Tip>
  </Step>
</Steps>

## Rotate credentials

If your bearer token may have been exposed, regenerate it in **Settings → Security** and update Google with the new token before revoking the old one.

## Remove SCIM

Disconnect SCIM from the Security page when decommissioning automated provisioning. Review active members afterward.

See [Security documentation](/dashboard/security/introduction).