Skip to main content
Which SCIM setup applies to you? These pages describe Living Security SCIM. Open the SCIM card in your settings. If the card shows Set up SCIM, or its Mode row says Native SCIM, these pages apply. If Mode says Current SCIM, your organization still uses the earlier SCIM setup. An admin can move it: see Move from the earlier SCIM setup. If the card says SCIM is set up and managed in the setup wizard, use SCIM Provisioning.
Google Workspace provisions users only to apps it supports. In most Google Workspace accounts it cannot send SCIM to a base URL and token you enter, so it cannot connect to Living Security SCIM on its own.

What Google Workspace offers

  • Catalog apps. Google Workspace provisions users to apps in its own catalog with connectors Google builds. Living Security SCIM is not one of these connectors.
  • Custom SCIM profiles. Google offers automated provisioning to a custom SAML app that supports SCIM 2.0 as a beta, for a limited number of customers. If your account has it, the app’s details page in the Admin console shows Autoprovisioning.
Living Security has not tested Google Workspace custom SCIM profiles. Living Security SCIM follows the SCIM 2.0 standard (RFC 7643 and RFC 7644), so a standard SCIM 2.0 client should work.

If your Admin console shows Autoprovisioning

1

Create the SCIM token in Living Security

On the SCIM card, select Set up SCIM. Copy the SCIM base URL and the Bearer token. You can’t see the token again. See Set up a SCIM connection.
2

Set up autoprovisioning

Open the Living Security SAML app in the Google Admin console, then Autoprovisioning. Enter the SCIM base URL and the token as a bearer token, as Google’s custom SCIM profile setup asks.
3

Map the attributes

Map the primary email to userName and to emails[type eq "work"].value, and map first name, last name, job title and department. See the SCIM attribute reference.
4

Test with one person

Turn on the app for one organizational unit or group that holds only your test person, and follow Test your SCIM setup.

If it does not

Use one of these instead:
  • Another identity provider that reads Google Workspace. For example, JumpCloud and Okta can import people from Google Workspace and send them to Living Security with SCIM. See Set up JumpCloud and Set up Okta.
  • SSO with just-in-time sign-in. Set up SSO with Google Workspace as the identity provider. Living Security creates each person at their first sign-in. Just-in-time sign-in does not update profiles or deactivate anyone, so remove leavers in Workforce → People yourself. See SCIM, SSO and just-in-time sign-in.
  • Other directory sources. See SCIM Provisioning for the other ways to bring people into Living Security.

Test your setup

If you use autoprovisioning, follow Test your SCIM setup: check the Checklist tab, provision one person, read the Attributes tab, and have the person sign in.

Troubleshoot

  • No Autoprovisioning section. Your account does not have Google’s custom SCIM profiles. Use one of the options in If it does not.
  • 401 (LS-SCIM-1001). Copy the SCIM base URL and a current token from the SCIM card again.
  • No usable email (LS-SCIM-1107). Map the primary email to emails[type eq "work"].value.
Every code is in the SCIM error reference.