Datadog SCIM provisioning from Google Workspace

Datadog has a SCIM 2.0 API at https://api.datadoghq.com/api/v2/scim, called with the application key of a service account. Most of this guide shows how to create that service account and its key. In AnySCIM you then paste the key, check the URL for your Datadog site and choose who gets Datadog.

Before you start

• A Datadog Infrastructure Pro or Enterprise plan.
• A Datadog admin who can create service accounts.
• Your Datadog site, shown in the address bar when you sign in, for example app.datadoghq.com or app.datadoghq.eu.

Step 1: Create the Datadog service account and application key

1. In Datadog, open Organization Settings from your account menu.
2. Under Accounts, select Service Accounts and click New Service Account.
3. Enter a name, for example AnySCIM, and an email address your team reads.
4. In Assign Roles, choose Datadog Admin Role, or a custom role with the user_access_invite and user_access_manage permissions. Click Create Service Account.
5. Select the new service account. In its side panel, click New Key, name it, for example anyscim-scim, and click Create Key.
6. Copy the key now. Datadog shows a service account's application key only once.

Step 2: Add the key to AnySCIM

The base URL uses the API host of your Datadog site, not the app host:

1. Open Connections → New connection and choose Datadog.
2. The base URL is filled in for US1. On another site, replace it with your site's URL from the table.
3. Paste the application key and click Test connection.
4. Choose who gets Datadog: tick the Google groups or organizational units, for example engineering and SRE. Leave Push group membership off unless Datadog support has turned on SCIM provisioning for Teams in your organization.
5. Check the dry-run and click Activate connection.

Good to know

• Roles: new users get your organization's default role, if one is set. Change roles in Datadog.
• SAML: SSO is recommended but not required. If you use SAML, turn off SAML just-in-time provisioning, so only SCIM creates users.
• Leavers: when a Google user is suspended, AnySCIM sends active: false and Datadog disables the user.

Troubleshooting

• 401 or 403 on every request: the key was revoked, or the service account's role lacks user_access_invite and user_access_manage.
• 404 on every request: the base URL uses the app host (app.datadoghq.com) or the wrong site. Use the API host from the table above.
• Errors on groups: SCIM provisioning for Teams isn't enabled for your organization. Turn off Push group membership, or ask Datadog support to enable it.

FAQ

Which Datadog plans support SCIM?

Infrastructure Pro and Infrastructure Enterprise. Datadog documents connectors for Microsoft Entra ID and Okta, and its SCIM API works with other SCIM clients such as AnySCIM.

Which key does Datadog SCIM use?

A Datadog application key, ideally from a service account whose role has the user_access_invite and user_access_manage permissions. AnySCIM sends it as the bearer token.

Can Google groups become Datadog Teams?

Only if Datadog has enabled SCIM provisioning for Teams in your organization; it's available on request from Datadog support. Until then, leave Push group membership off and manage teams in Datadog.