Sync Google Workspace Users to Auth0 with Directory Sync

Prerequisites

Before you begin:

Create an Enterprise connection for Google Workspace.
- Select Enable Users API on the connection under Auth0 APIs in the connection settings.
- Google Workspace domain admin completes authorization for Auth0 to access the Google Workspace Users API.

Steps

To set up Google Workspace Directory Sync:

Enable Directory Sync

Use Auth0 Dashboard or the Management API to enable Directory Sync with your Google Workspace connection.

Auth0 Dashboard
Management API

Navigate to Auth0 Dashboard > Authentication > Enterprise.
Create an enterprise connection or open your existing Google Workspace connection.
Select Enable Users API under General when creating a new connection or on the Settings tab of an existing connection.
A. Save your changes.
B. Complete administrator consent under the Setup tab to authorize Google Workspace.
Select the Provisioning tab.
Toggle on Provision Users Using Directory Sync.
Configure:
A. Attribute Mapping to control which Google attributes are written into the Auth0 user profile.
B. Enable Automated Synchronizations to run the sync automatically.
Save your changes.
To run an on-demand sync, choose Synchronize Now.

Before you start

To call Management API, you need:

A Management API access token with the following scopes:
- create:directory_provisionings
- read:directory_provisionings
- update:directory_provisionings
- delete:directory_provisionings
Your Google Workspace connection ID (CONNECTION_ID).

Create or enable Directory Sync for the connection

Call the Create a directory provisioning configuration endpoint.

https://{{YOUR_AUTH0_DOMAIN}}/api/v2/connections/{{CONNECTION-ID}} /directory-provisioning

Example request body to enable automatic sync:

tsx

{
    "mapping": [
        {
            "idp": "id",
            "auth0": "id"
        },
        {
            "idp": "primaryEmail",
            "auth0": "email"
        },
        {
            "idp": "primaryEmail",
            "auth0": "primaryEmail"
        },
        {
            "idp": "name.fullName",
            "auth0": "name"
        },
        {
            "idp": "name.givenName",
            "auth0": "given_name"
        },
        {
            "idp": "name.familyName",
            "auth0": "family_name"
        },
        {
            "idp": "isAdmin",
            "auth0": "isAdmin"
        },
        {
            "idp": "isAdmin",
            "auth0": "is_admin"
        },
        {
            "idp": "isDelegatedAdmin",
            "auth0": "isDelegatedAdmin"
        },
        {
            "idp": "agreedToTerms",
            "auth0": "agreedToTerms"
        },
        {
            "idp": "agreedToTerms",
            "auth0": "tou_accepted"
        },
        {
            "idp": "suspended",
            "auth0": "suspended"
        },
        {
            "idp": "suspended",
            "auth0": "is_suspended"
        },
        {
            "idp": "suspended",
            "auth0": "blocked"
        },
        {
            "idp": "suspensionReason",
            "auth0": "suspensionReason"
        },
        {
            "idp": "archived",
            "auth0": "archived"
        },
        {
            "idp": "ipWhitelisted",
            "auth0": "ipWhitelisted"
        },
        {
            "idp": "ipWhitelisted",
            "auth0": "is_ipWhitelisted"
        },
        {
            "idp": "kind",
            "auth0": "kind"
        },
        {
            "idp": "etag",
            "auth0": "etag"
        },
        {
            "idp": "customerId",
            "auth0": "customerId"
        },
        {
            "idp": "orgUnitPath",
            "auth0": "orgUnitPath"
        },
        {
            "idp": "emails",
            "auth0": "emails"
        },
        {
            "idp": "phones",
            "auth0": "phones"
        },
        {
            "idp": "externalIds",
            "auth0": "externalIds"
        },
        {
            "idp": "aliases",
            "auth0": "aliases"
        },
        {
            "idp": "addresses",
            "auth0": "addresses"
        },
        {
            "idp": "organizations",
            "auth0": "organizations"
        },
        {
            "idp": "nonEditableAliases",
            "auth0": "nonEditableAliases"
        },
        {
            "idp": "relations",
            "auth0": "relations"
        },
        {
            "idp": "languages",
            "auth0": "languages"
        },
        {
            "idp": "posixAccounts",
            "auth0": "posixAccounts"
        },
        {
            "idp": "notes",
            "auth0": "notes"
        },
        {
            "idp": "websites",
            "auth0": "websites"
        },
        {
            "idp": "locations",
            "auth0": "locations"
        },
        {
            "idp": "keywords",
            "auth0": "keywords"
        },
        {
            "idp": "gender",
            "auth0": "gender"
        },
        {
            "idp": "ims",
            "auth0": "ims"
        },
        {
            "idp": "creationTime",
            "auth0": "creationTime"
        },
        {
            "idp": "lastLoginTime",
            "auth0": "lastLoginTime"
        },
        {
            "idp": "changePasswordAtNextLogin",
            "auth0": "changePasswordAtNextLogin"
        },
        {
            "idp": "isMailboxSetup",
            "auth0": "isMailboxSetup"
        },
        {
            "idp": "includeInGlobalAddressList",
            "auth0": "includeInGlobalAddressList"
        },
        {
            "idp": "thumbnailPhotoUrl",
            "auth0": "thumbnailPhotoUrl"
        },
        {
            "idp": "thumbnailPhotoEtag",
            "auth0": "thumbnailPhotoEtag"
        },
        {
            "idp": "isEnrolledIn2Sv",
            "auth0": "isEnrolledIn2Sv"
        },
        {
            "idp": "isEnforcedIn2Sv",
            "auth0": "isEnforcedIn2Sv"
        },
        {
            "idp": "recoveryEmail",
            "auth0": "recoveryEmail"
        },
        {
            "idp": "recoveryPhone",
            "auth0": "recoveryPhone"
        },
        {
            "idp": "sshPublicKeys",
            "auth0": "sshPublicKeys"
        },
        {
            "idp": "customSchemas",
            "auth0": "customSchemas"
        },
 {
            "idp": "id",
            "auth0": "app_metadata.externalId"
        },
    ],
    "synchronize_automatically": true
}

Verify or update an existing configuration

To read the configuration settings, call Get a directory provisioning configuration

GET https://{{YOUR_AUTH0_DOMAIN}}/api/v2/connections/{{CONNECTION-ID}} /directory-provisioning

To update the connection configuration, call Patch a directory provisioning configuration.

PATCH https://{{YOUR_AUTH0_DOMAIN}}/api/v2/connections/{{CONNECTION-ID}} /directory-provisioning

Example request body (disable automatic sync)

{
	"synchronize_automatically": false
}

Run a manual sync

To trigger an on-demand sync, call Create a directory provisioning configuration.

POST https://{{YOUR_AUTH0_DOMAIN}}/api/v2/connections/{{CONNECTION-ID}} /directory-provisioning/synchronizations

Disable Directory Sync

To disable Directory Sync for the connection, call Delete a directory provisioning configuration.

DELETE https:// {{YOUR_AUTH0_DOMAIN}} /api/v2/connections/ {{CONNECTION-ID}} /directory-provisioning

Monitor Directory Sync

Monitor sync activity in Auth0 Logs:

directory_sync_started
directory_sync_completed

Sync Frequency Limits

Automated sync runs every 30 minutes after the last sync completes.
A manual sync triggered within 30 minutes of the previous completed job will return a 400 Bad Request error.

Best Practices

For new Google Workspace connections, we recommend using the Google user id instead of email for the Auth0 user_id.
If you enable Directory Sync, consider disabling Sync User Profile Attributes at Login to avoid conflicting updates from multiple sync methods.

Add Login

Provision Users

​Prerequisites

​Steps

​Enable Directory Sync

Before you start

​Create or enable Directory Sync for the connection

​Verify or update an existing configuration

​Run a manual sync

​Disable Directory Sync

​Monitor Directory Sync

​Sync Frequency Limits

​Best Practices