google workspace scim endpoint unreachable during provisioning

Fix Google Workspace auto-provisioning failing on an unreachable SCIM endpoint

TL;DR

Google's provisioning service cannot reach the app's SCIM URL - a DNS, firewall, or bad-URL problem, not a Google problem. Make the endpoint publicly reachable over HTTPS with a valid certificate, confirm no extra auth sits in front of it, and re-test the connection from the Google Admin console. Most failures are a URL typo or a non-public endpoint.

The error

Auto-provisioning error: Could not reach the SCIM endpoint
Google Admin / Apps / Web and mobile apps / [app] / Auto-provisioning / logs show "Connection failed"

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=google%20workspace%20scim%20endpoint%20unreachable%20during%20provisioning"

Fix it

Step 1: Verify the exact SCIM URL in the Admin console

Open Google Admin / Apps / Web and mobile apps / [app] / Auto provisioning and copy the SCIM base URL character by character.

Expected: a clean https URL like YOUR_HOST/scim/v2 with no typos. Typos here are the most common cause.

Step 2: Prove the endpoint is reachable from the public internet

curl -s -o /dev/null -w "%{http_code}" YOUR_HOST/scim/v2/ServiceProviderConfig

Expected: 200 (or 401 if it requires auth - that still proves reachability). A DNS failure, timeout, or connection refused means the host is not publicly routable, and that is the whole problem.

Step 3: Check TLS and anything in front of the endpoint

Confirm a valid publicly trusted certificate, and that no WAF challenge, IP allowlist, or login page sits in front of the SCIM path.

Expected: a plain HTTPS response with a trusted cert. Google's provisioner cannot pass a CAPTCHA or an IP allowlist.

Step 4: Re-test the connection in the Admin console

In Auto provisioning settings, re-enter the bearer credential if needed and run the connection test.

Expected: success. If it still fails here after steps 1-3 pass, the URL in the console does not match the URL you tested.

Step 5: Trigger a manual sync for one user

Assign the app to a single test user and check the auto-provisioning audit log for that user.

Expected: the user provisions successfully and the log shows no connection errors.

When this applies

• Google auto-provisioning reports the endpoint unreachable or connection failed
• The connection test in the Admin console fails
• Provisioning never succeeded, not even once

When it doesn't

• The connection test passes but users fail to provision (check mappings and credentials)
• SAML login itself fails (separate from provisioning)
• Failures started suddenly on a working setup (check for expired certs or firewall changes)

Compatibility

Google Workspace auto-provisioning for SAML apps, SCIM 2.0 endpoints.

Variant phrasings

google workspace provisioning connection failed

Same root cause family. Work through reachability before touching credentials or mappings.

scim base url unreachable google admin

Double-check the path: some apps want /scim/v2 and others /api/scim. The vendor docs name the exact path.

Why it happens

Google's provisioning service runs from Google infrastructure, not from the admin's browser. Anything that is not publicly routable - internal hostnames, VPN-only hosts, IP-allowlisted endpoints, self-signed certificates - fails from Google's side even though it works from the admin's laptop. Public-internet reachability is the entire requirement.

Edge cases

• Trailing slash differences (/scim/v2 vs /scim/v2/) break some providers; match the vendor docs exactly
• IPv6-only hosts fail if the app does not listen on IPv6
• Endpoints that return an HTML login page instead of SCIM JSON fail schema checks later; fix the path

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6cZMwA-CbOErFN4tbGB0tg