domainwidedelegation.comStart free

Use cases → Multi-tenant and agencies

Synchronise user directories across multiple domains

Keep user records in sync between Workspace tenants using a delegated service account with directory read and write access.

Who it is forIT teams or service providers managing users across multiple Workspace tenants.
APIsAdmin SDK
Typical scopesadmin.directory.user

The problem

Manual user updates and mismatched directories cause login failures and missed mail routing. Keeping users in sync across multiple tenants is tedious and error-prone.

How it works

  1. Authorise a single delegated service account in each tenant with directory user scope.
  2. Fetch user lists from each tenant and compare for additions, removals, and updates.
  3. Apply changes to the target tenant(s) by creating, updating, or suspending users as needed.
  4. Log actions and errors per tenant for traceability.

What changes

User directories are kept consistent without manual cross-tenant updates.

The trap in this one. The Admin SDK's user creation and update endpoints are eventually consistent and changes can take several minutes to propagate. If you fetch a user list immediately after writing, you may miss new or updated users, leading to skipped syncs or duplicate creation attempts on the next run. Always build in a delay or reconciliation loop before assuming changes are visible.

Watch it explained

“Setting up SCIM provisioning for LastPass using Google Workspace” — LastPass on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

How do you handle conflicting updates from both sides?

Track a last-modified timestamp per user and apply the most recent change, but be aware that Admin SDK's timestamps can lag behind the actual write.

Can group memberships be synchronised in the same run?

Yes, but group changes are subject to the same propagation delays and may not reflect immediately in subsequent reads.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Provision users across multiple Workspace domains

Automate user creation and updates across several Google Workspace domains using a single delegated service account.

Synchronise contacts between Workspace domains

Keep user contact details in sync across multiple Google Workspace domains using a delegated automation account.

Synchronise contact directories across Workspace domains

Keep contacts in sync between separate Google Workspace domains using a delegated service account, avoiding manual exports and stale data.