New Relic SCIM provisioning from Google Workspace

New Relic supports automated user management with SCIM on the Pro and Enterprise editions. You set an authentication domain's source of users to SCIM, and New Relic shows an API access token once. AnySCIM uses it with https://scim-provisioning.service.newrelic.com/scim/v2 to create New Relic users from Google Workspace, import Google groups and deactivate people who leave.

Requirements

• New Relic Pro or Enterprise edition.
• SAML SSO for the authentication domain. Google Workspace can be the identity provider through a custom SAML app.
• A New Relic user with a core or full platform user type, in a group with the Authentication domain manager role.

Get the New Relic SCIM token

1. In New Relic, open Administration → Authentication domains and create or select the domain for your Google Workspace users.
2. Under Source of users, select SCIM and save.
3. Copy the API access token. New Relic shows it only once: if you lose it, generate a new one, which invalidates the old token.

The token doesn't expire.

Connect New Relic in AnySCIM

1. Open Connections → New connection and choose New Relic.
2. The base URL is pre-filled with https://scim-provisioning.service.newrelic.com/scim/v2. Paste the token and click Test connection.
3. In Scope, select the people who should have New Relic. Turn on Push group membership to import Google groups into New Relic.
4. Review the dry-run and activate.
5. In New Relic, open Access management and grant each imported group its roles and accounts. Until you do, provisioned users can sign in but have no access to any account.

How users are synced

• New users in scope are created in the authentication domain, with their Google email as userName. Name and title changes are pushed with PATCH.
• New users start as Basic users. AnySCIM doesn't send New Relic's nrUserType attribute, so upgrade users to Core or Full in New Relic's user management.
• Google groups become New Relic groups, with nested Google groups expanded. Roles and account access are granted to groups in New Relic, so access follows Google group membership.
• When a Google user is suspended, AnySCIM sets active: false and the user is deactivated in New Relic.

Troubleshooting

• Users have no access after provisioning: their groups don't have roles yet. Grant them in Access management.
• 409 "Resource already exists": a user or group with the same name already exists in the authentication domain. Remove the duplicate in New Relic, or exclude it from the scope.
• 401 on every request: the token was regenerated. Paste the new one into the connection.

FAQ

Which New Relic editions support SCIM?

Pro and Enterprise. Automated user management isn't available on the Free or Standard editions.

Does New Relic SCIM work with Google Workspace?

Yes. New Relic ships apps for Okta, Microsoft Entra ID and OneLogin, and documents its SCIM API for any other identity provider. AnySCIM connects Google Workspace to that API.

Can Google groups control New Relic roles?

Yes, in two steps. AnySCIM keeps New Relic group membership in sync with Google groups, and you grant each group its roles and accounts once in Access management.