domainwidedelegation.comStart free

Use cases → Multi-tenant and agencies

Synchronise user directories across multiple domains

Keep user records in sync between Workspace tenants using a delegated service account with directory read and write access.

Who it is forIT teams or service providers managing users across multiple Workspace tenants.
APIsAdmin SDK
Typical scopesadmin.directory.user

The problem

Manual user updates and mismatched directories cause login failures and missed mail routing. Keeping users in sync across multiple tenants is tedious and error-prone.

How it works

  1. Authorise a single delegated service account in each tenant with directory user scope.
  2. Fetch user lists from each tenant and compare for additions, removals, and updates.
  3. Apply changes to the target tenant(s) by creating, updating, or suspending users as needed.
  4. Log actions and errors per tenant for traceability.

What changes

User directories are kept consistent without manual cross-tenant updates.

The trap in this one. The Admin SDK's user creation and update endpoints are eventually consistent and changes can take several minutes to propagate. If you fetch a user list immediately after writing, you may miss new or updated users, leading to skipped syncs or duplicate creation attempts on the next run. Always build in a delay or reconciliation loop before assuming changes are visible.

Watch it explained

“Setting up SCIM provisioning for LastPass using Google Workspace” — LastPass on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

How do you handle conflicting updates from both sides?

Track a last-modified timestamp per user and apply the most recent change, but be aware that Admin SDK's timestamps can lag behind the actual write.

Can group memberships be synchronised in the same run?

Yes, but group changes are subject to the same propagation delays and may not reflect immediately in subsequent reads.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Synchronise contact directories across multiple tenants

Keep user and shared contacts consistent between Google Workspace tenants using a delegated service account and the Directory API.

Operate several Workspace tenants from one service account

Authorize the same client ID in each domain and switch tenants simply by changing who you impersonate.

Keep a registry of which tenant granted which scope

The single document that turns a multi-tenant delegation outage into a ten-minute fix.