SCIM can push Google Workspace groups and their members to 15Five. Only a subset of group attributes sync, and group-based de-provisioning does not work the same way as individual de-provisioning.
Before You Begin
- SCIM provisioning must already be enabled in your 15Five account.
- The 15Five non-gallery app must be added and authorized in Google Workspace.
- Groups must exist in Google Workspace before syncing. Groups created in 15Five cannot be imported into Google Workspace.
Steps
- Open the 15Five non-gallery app in Google Workspace.
- Navigate to the Set provisioning scope dialog box.
- Click the underscore field and begin typing your group name.
- Select a group from the list that appears.
- Repeat step 4 to add additional groups.
- To remove a group, click the X next to its name.
- Click Finish.
- Review the Provisioning summary dialog box, then click OK.
- Choose one of the following activation options:
- Click Activate provisioning (enable the button first if it is grayed out). - Set the app to On for everyone or On for some organizations, then reload the page and click Activate provisioning.
- Click Activate in the confirmation dialog box.
If Something Goes Wrong
| Issue | Check | Fix |
|---|---|---|
| Group does not appear in 15Five after sync | Confirm the group is assigned to the 15Five app in Google Workspace | Assign the group to the 15Five non-gallery app, then trigger a sync by updating any field |
| Group member not removed from 15Five after being removed from a group | Removing a member from a group does not de-provision them from 15Five | Un-assign the individual directly from the 15Five app in Google Workspace |
| Group admin field is blank in 15Five | SCIM does not pass group admin assignments | Add a group admin manually in 15Five after the group syncs |
| Group type changed back after a sync | SCIM only reads Group ID, not group type | Move the group to the correct group type in 15Five; future syncs will not override it |
Group De-Provisioning Constraint
Removing an individual from a Google Workspace group does not remove them from 15Five. The following sequence illustrates this:
- Create a group in Google Workspace.
- Add members to the group.
- Assign the group to the 15Five app in Google Workspace — members are provisioned to 15Five.
- Remove an individual from the group in Google Workspace — the individual is removed from the group in 15Five only. Their 15Five account remains active.
To de-provision an individual from 15Five, un-assign them individually from the 15Five application in Google Workspace. For consistency, assign individuals directly to the 15Five app rather than managing access through groups alone.
Key Rules
- Only two group attributes sync via SCIM: group name and group members.
- New groups synced via SCIM are placed in the Groups group type in 15Five by default.
- Account administrators must manually move groups to other group types in 15Five.
- Future SCIM syncs will not override a group's type after it has been moved, because the Group ID does not change.
- To merge two existing groups, perform the merge in Google Workspace. 15Five will update on the next sync.
- There is no way to pass a group admin through SCIM. Add group admins manually in 15Five after groups sync.
Not Covered Here
This article does not cover setting up SCIM provisioning for individual users — see Set up SCIM provisioning with Google Workspace.