# Fix Google Workspace auto-provisioning failing on an unreachable SCIM endpoint

## TL;DR
Google's provisioning service cannot reach the app's SCIM URL - a DNS, firewall, or bad-URL problem, not a Google problem. Make the endpoint publicly reachable over HTTPS with a valid certificate, confirm no extra auth sits in front of it, and re-test the connection from the Google Admin console. Most failures are a URL typo or a non-public endpoint.

## The error
```text
Auto-provisioning error: Could not reach the SCIM endpoint
Google Admin / Apps / Web and mobile apps / [app] / Auto-provisioning / logs show "Connection failed"
```

## Use this skill
Agent? Search Vectle for this error:
```bash
curl -s "https://vectle.com/api/v1/search?q=google%20workspace%20scim%20endpoint%20unreachable%20during%20provisioning"
```

## Fix it

### Step 1: Verify the exact SCIM URL in the Admin console

```bash
Open Google Admin / Apps / Web and mobile apps / [app] / Auto provisioning and copy the SCIM base URL character by character.
```

Expected: a clean https URL like YOUR_HOST/scim/v2 with no typos. Typos here are the most common cause.

### Step 2: Prove the endpoint is reachable from the public internet

```bash
curl -s -o /dev/null -w "%{http_code}" YOUR_HOST/scim/v2/ServiceProviderConfig
```

Expected: 200 (or 401 if it requires auth - that still proves reachability). A DNS failure, timeout, or connection refused means the host is not publicly routable, and that is the whole problem.

### Step 3: Check TLS and anything in front of the endpoint

```bash
Confirm a valid publicly trusted certificate, and that no WAF challenge, IP allowlist, or login page sits in front of the SCIM path.
```

Expected: a plain HTTPS response with a trusted cert. Google's provisioner cannot pass a CAPTCHA or an IP allowlist.

### Step 4: Re-test the connection in the Admin console

```bash
In Auto provisioning settings, re-enter the bearer credential if needed and run the connection test.
```

Expected: success. If it still fails here after steps 1-3 pass, the URL in the console does not match the URL you tested.

### Step 5: Trigger a manual sync for one user

```bash
Assign the app to a single test user and check the auto-provisioning audit log for that user.
```

Expected: the user provisions successfully and the log shows no connection errors.

## When this applies

- Google auto-provisioning reports the endpoint unreachable or connection failed
- The connection test in the Admin console fails
- Provisioning never succeeded, not even once

## When it doesn't

- The connection test passes but users fail to provision (check mappings and credentials)
- SAML login itself fails (separate from provisioning)
- Failures started suddenly on a working setup (check for expired certs or firewall changes)

## Compatibility

Google Workspace auto-provisioning for SAML apps, SCIM 2.0 endpoints.

## Variant phrasings

### google workspace provisioning connection failed

Same root cause family. Work through reachability before touching credentials or mappings.

### scim base url unreachable google admin

Double-check the path: some apps want /scim/v2 and others /api/scim. The vendor docs name the exact path.

## Why it happens

Google's provisioning service runs from Google infrastructure, not from the admin's browser. Anything that is not publicly routable - internal hostnames, VPN-only hosts, IP-allowlisted endpoints, self-signed certificates - fails from Google's side even though it works from the admin's laptop. Public-internet reachability is the entire requirement.

## Edge cases

- Trailing slash differences (/scim/v2 vs /scim/v2/) break some providers; match the vendor docs exactly
- IPv6-only hosts fail if the app does not listen on IPv6
- Endpoints that return an HTML login page instead of SCIM JSON fail schema checks later; fix the path

## If it still fails

- Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
- Reproduce with a single test user so you are not debugging a crowd.
- If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

## Prevention

- Track credential and certificate expiry with alerts, not memory.
- Run a synthetic check per app daily so breakage pages you, not a user.
- Document mappings, URLs, and runbook steps where the next admin will find them.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_6cZMwA-CbOErFN4tbGB0tg