Access, Cloudflare One - Google Workspace SCIM user provisioning through generic SAML

<p>System for Cross-domain Identity Management (SCIM) is an open standard that synchronizes user identities between an identity provider and a service. For more information, refer to <a href="https://developers.cloudflare.com/cloudflare-one/team-and-resources/users/scim/">SCIM provisioning</a>. Google Workspace is rolling out custom SCIM profiles in beta. Organizations with access to the feature can use Google's built-in provisioning service to send user updates and deprovisioning events to Cloudflare One.</p> <p><strong>You must use a generic SAML identity provider in Cloudflare One.</strong> The dedicated Google Workspace integration does not support SCIM. Configure a SAML app in Google, then enter the Cloudflare SCIM endpoint and secret in the app's autoprovisioning settings. Turn on <strong>Enable user deprovisioning</strong> in Cloudflare One to revoke active Access sessions when Google deprovisions a user. Google's configured deprovisioning delay still applies. Support for the existing Google Workspace OIDC client will be added once Google adds support for OIDC + SCIM.</p> <p>Group membership is configured separately. Have the Google SAML app send a <code>groups</code> attribute to include the user's selected Google groups during authentication. Selecting groups as a SCIM provisioning scope does not synchronize group membership, Google is still adding support for this in their SCIM provider.</p> <p>Cloudflare One users must first authenticate to Access or register a device with the Cloudflare One Client before SCIM updates can apply. Availability of custom SCIM profiles depends on Google's beta rollout.</p> <p>For setup instructions, refer to <a href="https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/google-workspace-saml/">Google Workspace (SAML/SCIM)</a>.</p>