I’m currently setting up SCIM provisioning between Microsoft Entra ID (Azure AD) and Google Workspace.

The goal is to map users from specific Azure AD groups to corresponding Organizational Units (OUs) in Google Workspace.

However, I’m unsure how to configure the attribute mapping to automatically place users in the right OU based on their Azure AD group membership.

Here’s what I’ve done so far:

SCIM provisioning is enabled between Azure AD and Google Workspace.
I’ve created Organizational Units (OUs) in Google Workspace (e.g., /Sales, /Engineering).
Users are being provisioned from Azure AD to Google Workspace, but they’re being placed in the default organizational unit, not in the correct OU based on their group.

What I need:

I want to map Azure AD groups to specific OUs in Google Workspace, so that members of, say, the Sales group in Azure AD automatically get provisioned to the /Sales OU in Google Workspace.

Questions:

How can I configure Azure AD attribute mappings to ensure that users are provisioned into the correct OU based on their group membership?

Is there a specific custom attribute I need to add in Azure AD to represent the organizational unit path for mapping?

Are there any specific configurations I should do on the Google Workspace side (e.g., using dynamic groups or policies)?

Additional Info:

Using Azure AD as the Identity Provider with SSO set up via SAML.
Provisioning works, but users are being placed in the top-level OU in Google Workspace.

Any guidance on how to achieve this group-to-OU mapping would be greatly appreciated. Thanks!