Identity Automation: Google Workspace Organizational Unit Provisioning with Microsoft Entra ID

Problem

As part of a Google Workspace pilot deployment, users needed to be automatically placed into specific Google Workspace Organizational Units (OUs) to receive different service entitlements (such as Gemini and NotebookLM). While user lifecycle management was already handled through Microsoft Entra ID SCIM provisioning, Google Workspace OU placement remained a manual administrative task.

The objective was to automate OU assignment while maintaining Microsoft Entra ID as the single source of truth and avoiding additional synchronization tools or custom automation.

Solution

Designed and implemented a solution using Microsoft Entra ID Enterprise Application App Roles combined with SCIM expression mapping to dynamically populate the Google Workspace OrgUnitPath attribute during user provisioning.

The implementation leveraged the SingleAppRoleAssignment([appRoleAssignments]) expression to map App Role Display Names directly to Google Workspace Organizational Unit paths, allowing OU placement to be driven entirely by Microsoft Entra ID group membership and Enterprise Application role assignments.

Several alternative approaches—including Google Directory Sync, Azure Automation, and custom attribute mapping—were evaluated before selecting the App Role-based design due to its simplicity, maintainability, and minimal operational overhead.

Architecture

Microsoft Entra ID Security Group │ ▼ Enterprise Application App Role Assignment │ ▼ SCIM Provisioning Expression (SingleAppRoleAssignment) │ ▼ Google Workspace OrgUnitPath │ ▼ Automatic Organizational Unit Placement │ ▼ Google Workspace Service Access

Outcome

• Eliminated manual Google Workspace Organizational Unit administration.
• Established Microsoft Entra ID as the authoritative source for Google Workspace OU placement.
• Reduced administrative effort by enabling group-driven provisioning.
• Successfully validated automated OU reassignment using Provision on Demand and production provisioning logs.
• Delivered a scalable design without requiring Azure Automation, PowerShell scripting, or additional synchronization services.

Key Takeaways

• Designed a group-driven identity provisioning workflow using Microsoft Entra ID App Roles and SCIM expression mapping.
• Validated that SingleAppRoleAssignment([appRoleAssignments]) can be used to dynamically populate the Google Workspace OrgUnitPath attribute.
• Reduced operational complexity by eliminating the need for custom automation or secondary directory synchronization solutions.
• Reinforced the principle of maintaining a single authoritative identity source while minimising administrative overhead.