Amplitude SCIM provisioning from Google Workspace

Amplitude's SCIM API is available on the Enterprise plan. An admin enables SCIM provisioning and generates a SCIM key, and AnySCIM uses it with https://core.amplitude.com/scim/1 to invite people from Google Workspace to your Amplitude organization, sync Google groups to Amplitude groups and remove people when they leave.

Requirements

• An Amplitude Enterprise plan.
• An Amplitude admin with access to the organization's Access and SSO settings.
• A Google Workspace source already connected. See Connect Google Workspace.

Generate the Amplitude SCIM key

1. In Amplitude, open the organization settings and go to Access and SSO Settings → Provisioning Settings.
2. Set Enable SCIM Provisioning to Enabled.
3. Click Generate SCIM Key and copy the key. It identifies your organization, so the base URL is the same for every Amplitude customer in a region.

Connect Amplitude in AnySCIM

1. Open Connections → New connection and choose Amplitude.
2. The base URL is pre-filled with https://core.amplitude.com/scim/1. If your organization uses EU data residency, change it to https://core.eu.amplitude.com/scim/1.
3. Paste the SCIM key and click Test connection.
4. In Scope, select the people who should have Amplitude. Turn on Push group membership to create Amplitude groups from Google groups.
5. Review the dry-run and activate.

How users are synced

• New users in scope are created with their Google email as userName, and Amplitude emails them an invitation to finish signing up. Amplitude counts invited users as active, so they aren't invited twice.
• Project roles are managed in Amplitude, not through SCIM.
• Google groups become Amplitude groups, with nested Google groups expanded. When someone leaves a Google group, AnySCIM removes them from the Amplitude group, using the removal format Amplitude documents.
• When a Google user is suspended, AnySCIM sets active: false: Amplitude removes the user from the organization and they lose all access. For someone who hadn't accepted yet, the invitation is revoked.
• Amplitude identifies users by email and doesn't support changing it. If someone's Google email changes, AnySCIM provisions the new address as a new Amplitude user.

Troubleshooting

• First sync is slow: Amplitude's SCIM API accepts 100 requests per minute per organization. AnySCIM retries requests that hit the limit, so a large first sync simply takes longer. Amplitude support can raise the limit for a one-off import.
• 401 on every request: the SCIM key was regenerated or SCIM was disabled. Generate a key and update the connection.
• "returned non-matching resources" on a group: AnySCIM looks up each group by name and checks the answer. If Amplitude returns a different group, AnySCIM stops instead of changing the wrong one. Turn off Push group membership and manage Amplitude groups in Amplitude.

FAQ

Which Amplitude plan supports SCIM?

Enterprise. The SCIM API and SCIM provisioning settings are only available on Amplitude's Enterprise plan.

What happens to an Amplitude user when they leave?

When their Google account is suspended, AnySCIM sends active: false and Amplitude removes them from the organization. If they never accepted their invitation, it's revoked.

Can Google groups manage Amplitude groups?

Yes. With Push group membership on, AnySCIM creates an Amplitude group for each Google group in scope and keeps its members in sync, adding new members and removing people who leave the Google group.

Does AnySCIM work with Amplitude's EU data center?

Yes. Use https://core.eu.amplitude.com/scim/1 as the base URL with a SCIM key generated in your EU organization.