# Amplitude SCIM provisioning from Google Workspace

> Invite and remove Amplitude users and sync groups from Google Workspace with the Amplitude SCIM API on Enterprise. SCIM key, US and EU URLs, setup.

**Amplitude's SCIM API is available on the Enterprise plan.** An admin enables SCIM provisioning and generates a SCIM key, and AnySCIM uses it with `https://core.amplitude.com/scim/1` to invite people from Google Workspace to your Amplitude organization, sync Google groups to Amplitude groups and remove people when they leave.

## Requirements

- An Amplitude **Enterprise** plan.
- An Amplitude admin with access to the organization's **Access and SSO** settings.
- A Google Workspace source already connected. See [Connect Google Workspace](/docs/google-workspace).

## Generate the Amplitude SCIM key

1. In Amplitude, open the organization settings and go to **Access and SSO Settings → Provisioning Settings**.
2. Set **Enable SCIM Provisioning** to **Enabled**.
3. Click **Generate SCIM Key** and copy the key. It identifies your organization, so the base URL is the same for every Amplitude customer in a region.

## Connect Amplitude in AnySCIM

1. Open **Connections → New connection** and choose **Amplitude**.
2. The base URL is pre-filled with `https://core.amplitude.com/scim/1`. If your organization uses EU data residency, change it to `https://core.eu.amplitude.com/scim/1`.
3. Paste the SCIM key and click **Test connection**.
4. In **Scope**, select the people who should have Amplitude. Turn on **Push group membership** to create Amplitude groups from Google groups.
5. Review the dry-run and activate.

## How users are synced

- New users in scope are created with their Google email as `userName`, and Amplitude emails them an invitation to finish signing up. Amplitude counts invited users as active, so they aren't invited twice.
- Project roles are managed in Amplitude, not through SCIM.
- Google groups become Amplitude groups, with nested Google groups expanded. When someone leaves a Google group, AnySCIM removes them from the Amplitude group, using the removal format Amplitude documents.
- When a Google user is suspended, AnySCIM sets `active: false`: Amplitude removes the user from the organization and they lose all access. For someone who hadn't accepted yet, the invitation is revoked.
- Amplitude identifies users by email and doesn't support changing it. If someone's Google email changes, AnySCIM provisions the new address as a new Amplitude user.

## Troubleshooting

- **First sync is slow:** Amplitude's SCIM API accepts 100 requests per minute per organization. AnySCIM retries requests that hit the limit, so a large first sync simply takes longer. Amplitude support can raise the limit for a one-off import.
- **401 on every request:** the SCIM key was regenerated or SCIM was disabled. Generate a key and update the connection.
- **"returned non-matching resources" on a group:** AnySCIM looks up each group by name and checks the answer. If Amplitude returns a different group, AnySCIM stops instead of changing the wrong one. Turn off **Push group membership** and manage Amplitude groups in Amplitude.

## FAQ

### Which Amplitude plan supports SCIM?

Enterprise. The SCIM API and SCIM provisioning settings are only available on Amplitude's Enterprise plan.

### What happens to an Amplitude user when they leave?

When their Google account is suspended, AnySCIM sends `active: false` and Amplitude removes them from the organization. If they never accepted their invitation, it's revoked.

### Can Google groups manage Amplitude groups?

Yes. With **Push group membership** on, AnySCIM creates an Amplitude group for each Google group in scope and keeps its members in sync, adding new members and removing people who leave the Google group.

### Does AnySCIM work with Amplitude's EU data center?

Yes. Use `https://core.eu.amplitude.com/scim/1` as the base URL with a SCIM key generated in your EU organization.