# Google Workspace SCIM Bridge

This guide walks you through setting up the Probo Bridge to automatically synchronize users from Google Workspace into Probo via SCIM.

## Prerequisites

- Google Workspace administrator access (to create OAuth credentials)
- Probo organization administrator access
- A Google Cloud project with the Admin SDK API enabled

## How It Works

The Google Workspace Bridge connects to Google's Admin Directory API using OAuth2, retrieves your organization's user directory, and synchronizes it with Probo through the SCIM endpoint. The Bridge runs on a regular schedule and handles:

- **New users**: Creates Probo accounts for users found in Google Workspace
- **Updated users**: Syncs attribute changes (name, title, department, etc.)
- **Removed users**: Deactivates Probo accounts for users no longer in Google Workspace
- **Excluded users**: Skips users you've explicitly excluded by email

### Mapped Attributes

| Google Workspace Field | SCIM Attribute              |
| ---------------------- | --------------------------- |
| Primary email          | `userName`, `emails`        |
| Display name           | `displayName`               |
| First name             | `name.givenName`            |
| Last name              | `name.familyName`           |
| Suspended status       | `active`                    |
| Job title              | `title`                     |
| Type of employee       | `userType`                  |
| Department             | `enterprise:department`     |
| Cost center            | `enterprise:costCenter`     |
| Employee ID            | `enterprise:employeeNumber` |
| Manager email          | `enterprise:manager`        |
| Language               | `preferredLanguage`         |

## Step 1: Create Google OAuth Credentials

1. Go to the [Google Cloud Console](https://console.cloud.google.com/)
2. Select or create a project for Probo integration
3. Go to **APIs & Services** > **Enabled APIs & Services**
4. Click **+ Enable APIs and Services** and enable the **Admin SDK API**
5. Go to **APIs & Services** > **Credentials**
6. Click **+ Create Credentials** > **OAuth client ID**
7. Configure the OAuth consent screen if prompted:

   | Field                  | Value                                                           |
   | ---------------------- | --------------------------------------------------------------- |
   | **App name**           | `Probo SCIM Bridge`                                             |
   | **User support email** | Your admin email                                                |
   | **Scopes**             | `https://www.googleapis.com/auth/admin.directory.user.readonly` |

8. Create the OAuth client ID:

   | Field                        | Value                                                              |
   | ---------------------------- | ------------------------------------------------------------------ |
   | **Application type**         | `Web application`                                                  |
   | **Name**                     | `Probo SCIM Bridge`                                                |
   | **Authorized redirect URIs** | `https://your-probo-domain.com/api/console/v1/connectors/complete` |

9. Save the **Client ID** and **Client Secret**

## Step 2: Configure the Bridge in Probo

1. Log in to Probo as an organization administrator
2. Go to **Organization Settings** > **Authentication** > **Auto-Provisioning**
3. Click **Add Connector** and select **Google Workspace**
4. Enter your OAuth credentials:

   | Field             | Value                           |
   | ----------------- | ------------------------------- |
   | **Client ID**     | Your Google OAuth Client ID     |
   | **Client Secret** | Your Google OAuth Client Secret |

5. Click **Authorize** to complete the OAuth flow — you'll be redirected to Google to grant access
6. After authorization, the Bridge connector will appear as **Pending**

## Step 3: Configure Exclusions (Optional)

If you have service accounts, shared mailboxes, or other users that should not be provisioned into Probo:

1. In the Bridge connector settings, go to **Excluded Users**
2. Add email addresses of users to exclude (case-insensitive)
3. Click **Save**

Excluded users will be skipped during synchronization. If an excluded user was previously provisioned, they will be removed on the next sync cycle.

## Step 4: Verify Synchronization

After the Bridge is configured, it will begin synchronizing on its regular schedule (approximately every 30 seconds for polling, with a 5-minute sync timeout).

1. Go to **Organization Settings** > **Authentication** > **Auto-Provisioning**
2. Check the Bridge state — it should transition from **Pending** to **Syncing** and then to **Active**
3. Go to **People** to verify users have been provisioned
4. Check the **Event Log** for detailed sync activity

## Setting a User's Role

Probo membership roles (**Owner**, **Admin**, and so on) are assigned in [People](/docs/product/roles-and-permissions) or mapped with the SAML [Role Attribute](/docs/product/sso/overview#membership-roles-from-saml). SCIM creates people as **Employee** by default.

Separately, syncing a job title and employment type helps Probo attribute policies and run meaningful access reviews. Without those profile fields, a user can still sign in but is harder to evaluate for least-privilege access.

Google Workspace syncs two relevant fields to Probo via the SCIM bridge:

- **Job title** → the user's position (for example, Software Engineer, Finance Manager, IT Administrator)
- **Type of employee** → their employment type (for example, Full-time, Part-time, Intern, Contractor, Freelance)

1. In the Google Admin console, go to **Directory** → **Users**
2. Select the user you want to update
3. Open **User information** → **Employee information**
4. Set the **Job title** field to the user's position
5. Set the **Type of employee** field to their employment type
6. Click **Save**
7. On the next sync, both values appear on the user's profile in Probo

:::tip
Keep job titles consistent across your team (avoid free-form variations like Eng, SWE, Engineer for the same role) so access reviews group people cleanly.
:::

## Troubleshooting

### Bridge Stuck in "Pending"

- **Cause**: OAuth authorization was not completed or the token has expired
- **Solution**: Re-authorize the Google Workspace connector by clicking **Authorize** again

### Bridge in "Failed" State

- **Cause**: The sync encountered an error (network issue, API rate limit, invalid credentials)
- **Solution**: Check the Event Log for error details. The Bridge will automatically retry with exponential backoff. If the issue persists after 10 consecutive failures, the Bridge will be disabled — fix the underlying issue and re-enable it manually.

### Users Not Appearing

- **Cause**: The Google OAuth scope may not include directory access, or users are in an organizational unit not visible to the admin account
- **Solution**: Verify the Admin SDK API is enabled and the OAuth consent screen includes the `admin.directory.user.readonly` scope

### Stale Users Not Deactivated

- **Cause**: Users may be in the exclusion list, or the sync hasn't completed a full cycle yet
- **Solution**: Check the exclusion list and wait for the next sync cycle. Each sync processes up to 500 users per page from Google Workspace.

### OAuth Token Expired

- **Cause**: The refresh token has been revoked or expired
- **Solution**: Re-authorize the connector. The Bridge automatically refreshes OAuth tokens, but if the refresh token itself is revoked (e.g., user removed app access in Google), you'll need to re-authorize.

## Combining with SSO

For the best experience, combine SCIM Bridge provisioning with SAML SSO:

1. **SCIM Bridge** handles user lifecycle — creating and deactivating accounts automatically
2. **SAML SSO** handles authentication — users sign in with their Google credentials

This means users get automatic Probo accounts when they join your organization and lose access when they leave, with no manual account management needed.

- [Google Workspace SSO](/docs/product/sso/google-workspace) — Set up SAML SSO alongside SCIM provisioning
- [SCIM Overview](/docs/product/scim/overview) — Compare Native and Bridge synchronization modes