Sentry SCIM provisioning from Google Workspace

Sentry supports SCIM on the Business and Enterprise plans. When you enable SCIM in your organization's auth settings, Sentry shows a SCIM base URL and an auth token. AnySCIM uses them with https://sentry.io/api/0/organizations/{organization_slug}/scim/v2 to add people from Google Workspace as organization members, turn Google groups into Sentry teams and remove people who leave.

Requirements

• A Sentry Business or Enterprise plan. SCIM is not available on trials.
• SAML SSO configured for the organization. Google Workspace can be the SAML identity provider through a custom SAML app.
• A Sentry user who can edit the organization's auth settings.

Enable SCIM in Sentry

1. In Sentry, go to Settings → Auth for your organization.
2. Under General Settings, select Enable SCIM and click Save Settings.
3. Sentry now shows SCIM Information with the SCIM Base URL and the Auth Token. Copy both.

Connect Sentry in AnySCIM

1. Open Connections → New connection and choose Sentry.
2. Replace the pre-filled base URL with the SCIM Base URL from Sentry, paste the Auth Token and click Test connection.
3. In Scope, select the people who should be Sentry members, for example your engineering groups. Turn on Push group membership to create a Sentry team for each Google group.
4. Review the dry-run and activate.

How users are synced

• New users in scope are added to the Sentry organization, matched by email (userName).
• New members get the default organization role set in Settings → Auth. AnySCIM doesn't send Sentry's sentryOrgRole attribute, so change roles in Sentry, and keep in mind that the Owner role can't be assigned through SCIM.
• Google groups become Sentry teams. Sentry lowercases team names and replaces spaces with dashes, so Platform Team becomes platform-team.
• When a Google user is suspended, AnySCIM sets active: false. Sentry treats this as removal and deletes the organization membership; the person's Sentry account itself remains.

Troubleshooting

• First and last names show as "N/A": Sentry's SCIM API doesn't store name.givenName or name.familyName. This is expected.
• Can't change a member in Sentry: members and team memberships managed by SCIM can only be changed from the identity provider. Change the Google group, or take the user out of scope.
• Requests fail after renaming the organization: the base URL contains the slug. Copy the new URL from Settings → Auth into the connection.

FAQ

Which Sentry plans support SCIM?

Business and Enterprise. Sentry doesn't offer SCIM on Developer, Team or trial plans.

Can AnySCIM create Sentry teams from Google groups?

Yes. Enable Push group membership in the connection scope: each Google group becomes a Sentry team, and nested Google groups are expanded so the team contains every effective member.

What happens to a Sentry user when they leave the company?

When their Google account is suspended, AnySCIM sends active: false and Sentry removes their membership from your organization at the next sync. Their Sentry user account isn't deleted.