domainwidedelegation.comStart free

Use cases → Multi-tenant and agencies

Provision users across multiple Workspace domains

Automate user creation and updates across several Google Workspace domains using a single delegated service account.

Who it is forIT operations teams at agencies or MSPs managing several client domains.
APIsAdmin SDK
Typical scopesadmin.directory.user

The problem

Manually creating and updating users in each domain is error-prone and slow, especially when onboarding users across dozens of tenants. Delegated automation reduces errors and ensures process consistency, but must handle each domain’s context, policies, and propagation quirks.

How it works

  1. Configure domain-wide delegation for the service account in each customer Workspace domain.
  2. For each provisioning event, select the correct customer domain and impersonate an admin user from that domain.
  3. Call the Admin SDK Directory API to create or update users, setting all required fields and custom attributes.
  4. Log all responses, including partial failures and warnings, per domain.

What changes

User provisioning is repeatable, auditable, and scalable across multiple domains, reducing manual effort and onboarding lag.

The trap in this one. The Admin SDK's Directory API does not guarantee immediate consistency: after creating a user, subsequent lookups (even in the same session) may return 404 for several seconds to minutes, especially in larger tenants. If your workflow assumes immediate user presence—such as assigning groups or licenses right after creation—those calls can fail silently or with misleading errors, leading to partial onboarding and hard-to-diagnose gaps. Retrying with backoff is essential; fixed delays are not reliable.

Watch it explained

“Bulk Create Google Workspace Users from Google Sheets” — SyncWithTech on YouTube. Third-party video, included because it covers this ground well. We are not affiliated with the channel.

Questions people ask

Can one service account manage users in all domains?

Yes, if domain-wide delegation is granted in each tenant, the same service account can impersonate an admin in any domain it is configured for.

How do I know when a new user is ready for group or license assignment?

Do not assume readiness immediately after creation. Poll for the user's existence with retries and exponential backoff before proceeding with further assignments.

Want this built?

This is a pattern we run in production. We will set up the delegation and build this on top of it — $500 per hour, most of it working the same day.

Talk to us Or read the setup guide

Related use cases

Synchronise contacts between Workspace domains

Keep user contact details in sync across multiple Google Workspace domains using a delegated automation account.

Synchronise contact directories across Workspace domains

Keep contacts in sync between separate Google Workspace domains using a delegated service account, avoiding manual exports and stale data.

Synchronise user directories across multiple domains

Keep user records in sync between Workspace tenants using a delegated service account with directory read and write access.