Configure Microsoft Office 365 auto-provisioning

Here's how to set up automated user provisioning for this third-party app. You can then authorize, create, modify, or delete a user's identity in Google Workspace. Any changes are also reflected in the third-party app.

Before you begin: Set up SSO for this app

Set up auto-provisioning for the Microsoft Office 365 application

  2. From the Admin console Home page, go to Apps and then Web and mobile apps.

  3. Open theMicrosoft Office 365application.
  4. In the Auto-provisioning section, click Configure auto-provisioning.
  5. Click Authorize.

    If you haven't signed into your Office 365 administrator account before clicking Authorize, Office 365 application opens in the same tab and you're prompted to sign in.

    Important: You might have to reauthorize if the admin password for Microsoft Office 365 has changed. Changing the admin password will cause the original authorization to be revoked.

  6. Verify that all mandatory Microsoft Office 365 attributes (those marked with an *) are mapped to Google Cloud Directory attributes. If not, click the Down arrow"" and map to the appropriate attribute.
  7. Click Continue.
  8.  (Optional) Restrict provisioning to specific groups:
    1. Enter all or part of a group name in the Search groups field.
      A list of available groups appears. Select a group to add it and open a new search field.
    2. If necessary, add more groups and choose a scope.
    3. To remove any group you added, click"" next to it.
  9. Once you're done, click Continue.
  10. Choose how long deprovisioning actions should be delayed before taking effect. You can set the time to: within 24 hours or after one, 7, or 21 days. Select at least one of these options:
    • When an app is turned off for the user, suspend their account, hard delete their account, or both after [number of days].
    • When a user is suspended on Google, suspend their account, hard delete their account, or both after [number of days].
    • When a user is deleted from Google, suspend their account, hard delete their account, or both after [number of days].
    • A suspended account is temporarily unavailable until it's restored.
    • A hard deleted account can only be restored without data loss using Microsoft Office 365 Admin Center up to 30 days after deletion. If you try to restore a hard deleted user in Google Workspace, you'll see the message "Please restore this deleted user from Microsoft Office 365 Admin Center." under User failures.

    Tip: Always set more time before hard deleting a user's account than for suspending a user's account.

  11. Click Finish.
  12. In the Auto-provisioning section, click the activation slider.

    Note: The activation slider is disabled if Microsoft Office 365 isn't turned on for any users. Click User access and turn the app on to enable the slider.

  13. In the confirmation dialog box, click Turn on.

Any new users provisioned from Google Workspace won't have any licenses assigned to them. You'll need to manage the user licenses from the Microsoft Office 365 Admin Center.

Display auto-provisioning

Once provisioning is on, Google starts collecting usage information. You'll see the usage information in the Auto-provisioning section. There won't be any numbers next to the event names until you enable provisioning.

The following event names provide the usage information for the last 30 days:

  • Users created
  • Users suspended
  • Users deleted
  • Failures

For more information, see Monitor automated user provisioning.

Edit provisioning scope

You may want to restrict the scope of provisioning to members of groups you define.

  2. From the Admin console Home page, go to Apps and then Web and mobile apps.

  3. Open the Microsoft Office 365 application.
  4. Click the Auto-provisioning section to open the settings page.
  5. Under Provisioning scope, click Edit.
  6. Enter all or part of a group name in the Search groups field. A list of available groups appears.
    1. Select a group to add it and open a new search field.
    2. If necessary, add more groups and choose a scope.
    3. To remove any group you added, click"" next to it.

    If a group has users from a secondary domain or from outside the organization, those users are not provisioned.

  7. Once you're done, click Update.

The next time you edit provisioning scope, the groups you added appear in theProvisioning scope window. If you turned on the Microsoft Office 365 application for a set of organizational units, the provisioning scope is restricted to those users in the added groups who are also members of those organizations.

Deactivate auto-provisioning

To disable auto-provisioning for the Microsoft Office 365 application without losing all the configuration information:

  2. From the Admin console Home page, go to Apps and then Web and mobile apps.

  3. Open theMicrosoft Office 365application.
  4. Do one of the following:
    • In the Auto-provisioning section, click the activation slider.
    • Click the Auto-provisioning section to open the settings page, then click Status and then Turn off.
  5. In the confirmation dialog box, click Turn off.

Define deprovisioning timeframes

To define how long deprovisioning actions should be delayed before taking effect:

  2. From the Admin console Home page, go to Apps and then Web and mobile apps.

  3. Open the Microsoft Office 365application.
  4. Click the Auto-provisioning section to open the settings page.
  5. Under Deprovisioning, click Edit.
  6. Choose how long deprovisioning actions should be delayed before taking effect. You can set the time to: within 24 hours or after one, 7, or 21 days. Select at least one of these options:
    • When an app is turned off for the user, suspend their account, hard delete their account, or both after [number of days].
    • When a user is suspended on Google, suspend their account, hard delete their account, or both after [number of days].
    • When a user is deleted from Google, suspend their account, hard delete their account, or both after [number of days].
    • A suspended account is temporarily unavailable until it's restored.
    • A hard deleted account can only be restored without data loss using Microsoft Office 365 Admin Center up to 30 days after deletion. If you try to restore a hard deleted user in Google Workspace, you'll see the message "Please restore this deleted user from Microsoft Office 365 Admin Center." under User failures.

    Tip: Always set more time before hard deleting a user's account than for suspending a user's account.

  7. Click Updateto save your edited deprovisioning configuration.

Remove auto-provisioning

To disable auto-provisioning for the Microsoft Office 365 application and remove all the configuration information:

  2. From the Admin console Home page, go to Apps and then Web and mobile apps.

  3. Open theMicrosoft Office 365application.
  4. Click the Auto-provisioning section to open the settings page.
  5. Under Delete configuration, click Delete.
  6. Click Delete to both deactivate auto-provisioning and remove all the configuration information.
    Existing users on Microsoft Office 365 will not be deprovisioned.

Important: If automatic provisioning stops and you need to reauthorize the application

If the admin password for Microsoft Office 365 has changed, automatic provisioning will stop working. In this case, the original authorization is revoked by Microsoft Office 365, and you must reauthorize automatic provisioning.

  2. From the Admin console Home page, go to Apps and then Web and mobile apps.

  3. Click theMicrosoft Office 365application.
  4. Click the Auto-provisioning section to open the settings page.
  5. Under App authorization, click Reauthorize.
  6. Click Re-authorize.

    If you haven't recently signed in to Microsoft Office 365, you may need to sign in during reauthorization.

After reauthorization completes, you're returned to the Auto-provisioning settings page in the Admin console.

Note: Your third-party application might revoke authorization for reasons other than the admin password changing. These reasons can include account inactivity, for example. Check with the documentation for the third-party application for scenarios in which authorization can be revoked.


Google, Google Workspace, and related marks and logos are trademarks of Google LLC. All other company and product names are trademarks of the companies with which they are associated.

Was this helpful?

How can we improve it?