Skip to main content
SCIM keeps Bifrost in sync with Google Workspace in real time - new users are provisioned, deactivated accounts are suspended, and group memberships are updated without waiting for the next background sync cycle.
Complete SSO using OIDC before setting up SCIM. The Google Workspace OIDC integration provides the OAuth credentials and Directory API access that SCIM provisioning builds on.

​
How Google Workspace provisioning works

Google Workspace does not natively push SCIM to external endpoints. Instead, Bifrost uses two complementary mechanisms: The Directory API sync is configured as part of the OIDC setup - no additional steps are required here if you already configured a service account.

​
Step 1: Verify Directory API access is configured

1

Confirm the service account is set up

The Directory API sync requires a Google Cloud service account with domain-wide delegation, configured in Steps 3 and 4 of the OIDC guide.If you skipped that section, return to the OIDC guide and complete it before continuing.
2

Confirm the scopes are authorized

In the Google Admin Console, go to Security → Access and data control → API controls → Manage Domain Wide Delegation.Verify the service account’s Unique ID is listed with all three scopes:
Google Admin Console Domain-Wide Delegation page showing the service account entry with scopes

Domain-Wide Delegation - verify the service account has the three Directory API scopes authorized.

​
Step 2: Configure sync scope in Bifrost

1

Open your Google Workspace provider

In your Bifrost dashboard, go to Governance → User Provisioning and open your configured Google Workspace provider.
2

Set group and team mappings

To control which Google Workspace groups are synced as Bifrost teams, configure Attribute-to-Team Mappings in the provider settings:
  • Use * as the value to sync the group displayName directly as the team name
  • Use a specific group name to map a single group to a named Bifrost team
Bifrost attribute mapping showing groups claim mapped to Bifrost teams

Attribute Mapping - map Google Workspace group memberships to Bifrost teams using the groups claim.

​
Provisioning source

The provider configuration includes a Provisioning source setting that controls whether IdP login claims still provision users, or whether SCIM is the sole source of truth:
Provisioning source dropdown showing SCIM and login claims (default) and SCIM only - ignore login claims options

The Provisioning source setting in the provider configuration - choose between SCIM and login claims (default) or SCIM only.

Choose SCIM only when provisioning must be fully controlled by your IdP’s SCIM app and login-time claim changes should never alter membership. Leave it on the default SCIM and login claims if users are also provisioned just-in-time on first login. This maps to the claimsSyncMode config key (both or scim) and is inert when SCIM is disabled - claims always sync then.

​
Step 3: Trigger and verify sync

1

Run a manual import

To sync users immediately without waiting for the 24-hour cycle, go to Governance → User Provisioning → Import Users.Filter by a Google Workspace group, click Preview, and confirm the expected users appear.Click Import to bring them into Bifrost with the roles assigned by your attribute mappings.
Bifrost Import Users screen showing a preview of users from a Google Workspace group

Import Users - preview users from a Google Workspace group before importing them into Bifrost.

2

Verify in Bifrost

After the sync or import:
  • Go to Governance → Users to see provisioned users and their assigned roles
  • Go to Governance → Teams to see teams populated from Google Workspace groups
  • Go to Governance → Business Units to see business units resolved from group or attribute mappings

​
How sync works

OIDC provisioning - users are provisioned in Bifrost on their first successful login. Role and team assignments are derived from the JWT claims at login time. Background reconciliation - every 24 hours, Bifrost reconciles all users in the directory against the current state in Google Workspace. This catches deactivations, group membership changes, and new users who have not yet logged in. Session refresh - every 15 minutes, Bifrost attempts to refresh active OIDC sessions. If a user’s Google account has been suspended or deleted, their Bifrost session is terminated at the next refresh cycle.

​
Troubleshooting

Users not appearing in Import Preview - confirm the service account has the three Directory API scopes authorized in Domain-Wide Delegation. Check that the adminEmail is a Super Admin or has the User Management Admin role. Group memberships not syncing - verify GroupMember.Read.All scope is included in Domain-Wide Delegation. Groups must be assigned to the Bifrost application in the Google Admin Console for the groups claim to appear in the token. Sync completes but roles are wrong - review your Attribute-to-Role Mappings in the provider settings. Use Discover Claims to inspect the live claims and confirm the group names match your mapping values exactly.