SCIM Setup with Google Workspace Directory Sync

This page explains the setup process for user provisioning with Google Workspace Directory Sync. For an overview of the SCIM functionality, see Managing users with SCIM provisioning, and if you're using Microsoft Entra or Okta as your IdP, see SCIM Setup with Client Credentials (Microsoft Entra) or SCIM Setup with Authorization Code (Okta).

• How Google Workspace Directory Sync works
• Before You Begin
• Step-by-Step Instructions
  • Step 1: Select Google Workspace Directory Sync in Read AI
  • Step 2: Create your sync group in Google Workspace
  • Step 3: Authorize Read AI in your Google Admin Console
  • Step 4: Save your configuration in Read AI
  • Step 5: Monitor provisioning
• Managing your configuration
• Notes and Troubleshooting

How Google Workspace Directory Sync works

Microsoft Entra and Okta both send user changes to Read AI from their own provisioning engines. Google Workspace doesn't offer that capability for applications outside its own catalog, so Google Workspace Directory Sync works the other way around: Read AI reads your Google directory on a schedule and updates your workspace to match.

The practical differences for you as an admin:

Read AI syncs each user's first name, last name, and primary email address from Google Workspace, along with whether their account is suspended. No other profile fields are read, and changes you make to other Google Workspace attributes won't affect Read AI.

Read AI requests read-only access to your directory (admin.directory.user.readonly and admin.directory.group.readonly). We can read user profiles, suspension status, and group membership. We cannot create, modify, or delete anything in your Google Workspace.

Before You Begin

• You must be a workspace admin or owner in Read AI.
• Your workspace must be on the Enterprise+ plan.
• You must verify the domain(s) for any users you want to provision (unless they are already in your workspace). The Google admin account you nominate below must also be in a verified domain, so it's worth completing domain verification first.
• You need super administrator access to your Google Workspace account to complete Step 3.

🔎 VERIFY: No source states what level of Google admin access is required to add a domain-wide delegation entry. I've written it loosely — if it's effectively super-admin-only, say so plainly instead.

Step-by-Step Instructions

Please make sure to follow these steps carefully, as a misconfiguration may prevent the integration from working or result in unexpected provisioning behavior.

You'll move between Read AI and the Google Admin Console, so it's easiest to open both in separate browser tabs before you start.

Step 1: Select Google Workspace Directory Sync in Read AI

1. Go to Workspace Settings and expand the Advanced section

   

2. Turn on Enable SCIM Provisioning.

   

3. Under Authentication Method, select Google Workspace Directory Sync.

   

   An Instructions panel will appear containing the two values you'll need in Step 3 below: Read AI's Client ID and the required Scopes. Each has a copy button.

   

4. Decide whether you want license auto-charge to be enabled. If disabled, provisioning will fail whenever you run out of available licenses in your workspace. You can configure a limit for the maximum number of seats your workspace can reach via auto-charge (more can always be purchased manually).

   

Leave this tab open — you'll come back to it in Step 4.

Step 2: Create your sync group in Google Workspace

Read AI provisions the members of one Google Group, which you identify by its email address. This is how you control who gets access.

1. In the Google Admin Console, create a group for this purpose if you don't already have one (for example, readai-provisioning@yourcompany.com).
2. Add the users who should have Read AI access. You can add individual users, or nest other groups inside it — Read AI expands nested groups automatically and reads the resulting flat list of users.
3. Make a note of the group's email address.

We recommend a dedicated group rather than reusing an existing one such as "All Employees," so that Read AI access stays something you grant deliberately.

Why a group instead of your whole directory? Syncing an entire domain pulls in shared mailboxes, service accounts, and retired employees. A group keeps the scope explicit and under your control.

Step 3: Authorize Read AI in your Google Admin Console

This step tells Google to trust Read AI's service account with read-only access to your directory. Google calls this domain-wide delegation (DWD).

You must be signed in as a super administrator to complete this step.

1. In the Google Admin Console, go to the Domain-wide Delegation page (Security → Access and data control → API controls → Domain-wide delegation).

2. Select Add new.

   

3. In Client ID, paste the Client ID you copied from Read AI in Step 1.

4. In OAuth scopes, paste the following, exactly as written, or copied from Read AI in Step 1:
   
   https://www.googleapis.com/auth/admin.directory.user.readonly, https://www.googleapis.com/auth/admin.directory.group.readonly

5. Select Authorize. Read AI should now appear in your list of API clients with those two read-only scopes.

Note: Authorization can take a few minutes to take effect across Google's systems. If Step 4 fails immediately after authorizing, wait a moment and try again.

Step 4: Save your configuration in Read AI

Back in your Read AI workspace settings, fill in the two email fields below the Instructions panel.

1. Google Admin Email — the Google Workspace admin account Read AI will impersonate to read your directory.
   
   This account must be in a domain you've already verified in Read AI; you'll find your verified domains in the same Advanced section, above the SCIM provisioning settings. It does not need to be your personal super admin account. We recommend creating a dedicated account with a read-only admin role instead, so that the access granted to Read AI is as narrow as possible.
    
2. Sync Group Email — the email address of the Google Group you created in Step 2 (for example, readai-provisioning@yourcompany.com).

3. Select Save Configuration. Read AI verifies both values against your directory and saves them. If either fails, the field is highlighted with an explanation (see Troubleshooting below).

On success, you'll see Email verified under the admin email and the group's name under the group email, and your first sync begins automatically.

Step 5: Monitor provisioning

Once saved, the bottom of the section shows when the last sync completed and the current status.

• Syncs run automatically every 30 minutes, creating and deactivating users in your Read AI workspace as necessary to keep it in sync with your group.
• Select Sync Now to run a sync immediately if necessary (for example, right after adding someone to the group). There's a short cooldown between manual syncs; the button is disabled until you can sync again.
• If the connection breaks, we email your workspace admins once, and a banner appears across your Read AI workspace until it's resolved.

Managing your configuration

Changing the admin email or sync group

Select Edit Configuration, make your changes, and save. Read AI re-verifies both values, exactly as it did during setup. Sync Now is unavailable while you have unsaved edits.

⚠️ Changing the sync group deactivates users who aren't in the new group. Anyone provisioned from your old group who isn't a member of the new one loses access at the next sync. Read AI asks you to confirm before applying this change.

Switching to a different IdP

If you switch from Google Workspace Directory Sync to Entra or Okta (or vice versa), users managed by your old configuration stay in your workspace but are no longer IdP-managed unless they also appear in the new configuration. You'll need to complete setup for the new method before provisioning resumes.

Turning provisioning off

Turn off Enable SCIM Provisioning. Previously provisioned users remain in your workspace and must be managed manually from then on. You can also revoke Read AI's access at any time from your Google Admin Console by removing the domain-wide delegation entry, which immediately cuts off our ability to read your directory.

Notes and Troubleshooting

Make sure to review the notes here to fully understand how SCIM provisioning works, and if you have any issues, check the troubleshooting tips.

Which users get provisioned

• Only active members of your sync group are provisioned. Users with a pending Google Workspace invitation are skipped until they accept it.
• If a user is suspended in Google Workspace, Read AI deactivates them and frees their seat, even if they're still listed in the group. Suspending or deleting an account in Google Workspace is the reliable way to remove someone's Read AI access.
• Removing a user from the sync group also deprovisions them at the next sync.
• Nested groups are expanded automatically, so a user only needs to be in the sync group indirectly to be provisioned.

Errors during setup

If provisioning stops working

When Read AI loses access to your directory, the status changes to Disconnected, syncing pauses, and a banner appears across your workspace reading "User Provisioning Paused - Action Required." We also email your workspace admins once. No users are added or deactivated while provisioning is paused.

The section itself explains which of the two problems occurred:

"Your Google admin email no longer has permission." The domain-wide delegation authorization is no longer valid, or the admin account has changed. Check that the entry for Read AI's Client ID still exists in your Google Admin Console with both scopes, and that the admin account still exists, isn't suspended, and can still read your directory.

"Your sync group email is no longer accessible." The group has been deleted, its address changed, or it's no longer visible to the admin account. Confirm the group still exists at that address, or select Edit Configuration to point at a different one.

Once the underlying problem is fixed, select Retry Sync. Syncing then restarts automatically — you don't need to reconfigure anything.

A user in the group didn't get provisioned

Check the troubleshooting section of the overview article — the usual causes (insufficient licenses, the user belongs to another workspace, an unverified email address) apply to Google Workspace Directory Sync the same way they do to Entra and Okta.

Occasionally an individual user can be skipped on one sync because of a transient error reading their Google profile. These resolve on their own — select Sync Now, or wait for the next scheduled sync, before investigating further.