Skip to main content
Google Workspace Directory Sync for Groups is currently available in Early Access.By using this feature, you agree to the applicable Free Trial terms in Okta’s Master Subscription Agreement. To learn more about Auth0’s product release cycle, read Product Release Stages.
Enabling Directory Sync for your Google Workspace enterprise connection lets you synchronize the user profiles, group structures, and group membership from Google Workspace to Auth0. You can synchronize automatically or manually:
  • Automatic synchronization runs every 30 minutes after the last sync completes.
  • Manual synchronization runs when you trigger it.

​
Enable Directory Sync

You can enable Directory Sync using the Auth0 Dashboard or the Management API.
1

Prerequisites

Before you begin, you must have:
2

Enable the admin directory API for your enterprise connection

To enable directory sync, the Google access token for your Google Workspace enterprise connection must have the the appropriate scopes to access Google’s APIs.On the Settings tab of an existing Google Workspace enterprise connection (or when creating new connection), in the Identity Provider API section, select Use Admin Directory API and choose:
  • Users scopes to add scopes only to access users.
  • Users and Groups scopes to add scopes to access both users and groups.
When using Directory Sync, we also recommend disabling Sync User Profile Attributes at Login in this section to avoid conflicting updates from multiple sync methods.
Click Save Changes.
3

Verify Google administrator consent

From Auth0 Dashboard > Authentication > Enterprise, open your Google Workspace connection. On the Setup tab, either:
  • Follow the Continue link if you have admin permissions to configure your Google Workspace settings to use Google’s Admin APIs, or
  • Provide the given URL to your administrator so that they can adjust the required settings
4

Enable Directory Sync

On the Provisioning tab of your connection, toggle Provision Users Using Directory Sync. and choose the your configuration options:
  • In Resources, under Sync. choose whether to sync Users or Users and Groups. If you sync both users and groups, the section expands to show which groups are syncing (Syncing all groups by default). To customize the synced groups, see the next step.
  • In Schedule, optionally check Enable Automatic Synchronization to automatically sync every 30 minutes. You can trigger a manual synchronization by selecting Synchronize now.
  • In Attribute Mapping, you can customize the mapping of Google attributes to Auth0 user profile attributes.
5

Customize synced groups (optional)

When you enable Directory Sync to synchronize both users and groups from Google Workspace, all groups are synchronized by default. You can customize which groups you synchronize by uploading a JSON of the group IDs you want to synchronize.First, compose the JSON file. You can get a list of all group IDs using the Google Workspace Directory API. Create the file in the following format, substituting the actual group IDs for the placeholder example values:
{
    "groups": [
        {
            "id": "example-id-1"
        },
        {
            "id": "example-id-2"
        },
        {
            "id": "example-id-3"
        }
    ]
}
Next, upload the file to Auth0:
  1. On the Provisioning tab of your connection, under the toggled Provision Users Using Directory Sync option, find the Resources section and select the Select Groups… button.
  2. In the Select Groups window that opens, select Pick specific groups to reveal the Groups JSON file section.
  3. Select + Choose file and upload the JSON file.
  4. After the file uploads, select Select Groups at the bottom of the window.
The Resources section displays Syncing specific groups. To update which groups you synchronize, return to the same Select Groups window and either upload a new JSON or choose Sync all.

​
Monitor Directory Sync activity

You can monitor sync activity in Auth0 tenant logs the under Directory Sync Started and Directory Sync Completed log types (event codes directory_sync_started and directory_sync_completed).

​
Limits

  • Synchronizing manually within 30 minutes of the last completed sync returns a 400 error. Wait at least 30 minutes before synchronizing again.