Google Workspace integration: Set up SCIM provisioning
Overview
Beta. This feature is currently in Beta.
Connect Google Workspace to Ramp with SCIM so that users with access to your Ramp app in Google are created, updated, and deactivated in Ramp automatically. During Beta, Google Workspace may not appear as a SCIM option for every Ramp business.
Setup happens in both Ramp and the Google Admin console. Ramp gives you an access token and endpoint URL, and you paste them into the autoprovisioning settings of a SAML app in Google. For how SCIM works in Ramp, including which fields your identity provider controls, see Setting up SCIM and managing user provisioning.
Before you set up Google Workspace SCIM
- Google super administrator: You need to sign in to the Google Admin console with a super administrator account.
- Autoprovisioning in Google: Ramp connects through Autoprovisioning on a SAML app in Google. If you don't see Autoprovisioning on the app's details page, see Google's guide to automated user provisioning with custom SCIM profiles.
- Fallback department and work location: The Google mappings in this guide don't include a work location, and department is optional. Ramp assigns the Department and Work location you choose as fallback user fields during setup to users added from Google who don't have them.
- Existing HR or SCIM integration: If your business already has an HR integration or a SCIM integration connected, Connect HR directory doesn't appear in the Invite menu. Disconnecting stops syncing from that integration, so during Beta, ask your Ramp account manager to confirm that Google Workspace SCIM is available for your business before you disconnect. Then disconnect the existing integration and set up Google Workspace SCIM.
Start Google Workspace SCIM setup in Ramp
- Go to People and open the Invite menu.
- Select Connect HR directory, then select Google.
- On Install Google SCIM, under Fallback user fields, choose a Department and Work location. Review the other default preferences, then click Next.
- Keep the Ramp setup page open. It shows the service provider details, access token, and endpoint URL you'll enter in Google.
Add Ramp as a SAML app in Google Workspace
-
Go to the Web and mobile apps page in the Google Admin console.
-
If you already sign in to Ramp with a Google SAML app, select that app and go to step 5. Otherwise, select Add app, then Add custom SAML app, name the app "Ramp", and click Continue.
-
On the Google Identity Provider details page, click Continue.
-
On the Service provider details page, enter the values below, then click Continue and Finish.
Field Value ACS URL The ACS URL shown on the Ramp setup page Entity ID The Entity ID shown on the Ramp setup page Name ID format EMAIL Name ID Basic Information > Primary email -
On the app's details page, open User access and turn the app on for everyone. Google can't turn on autoprovisioning until the app is on for at least one user.
To also use this app for Ramp sign-in, see Google Workspace SAML.
Configure Google Workspace autoprovisioning for Ramp
- On the app's details page, under Autoprovisioning, select Configure auto-provisioning.
- Copy the access token from the Ramp setup page, paste it into Access token, and click Continue.
- Copy the endpoint URL from the Ramp setup page, paste it into Endpoint URL, and click Continue.
- Google fills in the attribute mappings from Ramp. Confirm the mappings below, then click Continue.
Map the Google Directory attributes below to the matching app attributes. The employee ID and department mappings are optional.
| Google Directory attribute | App attribute | Notes |
|---|---|---|
| Basic Information > Username | userName | |
| Basic Information > Last name | name.familyName | |
| Basic Information > First name | name.givenName | |
| Email > Value | emails.value | |
| Employee Details > Employee ID | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:employeeNumber | Optional |
| Employee Details > Department | urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department | Optional |
Ramp doesn't support syncing managers from Google. If Google adds a manager mapping, remove it.
Turn on Google Workspace autoprovisioning for Ramp
- Optionally, choose the groups to provision. If you don't add any groups, everyone with access to the app is provisioned. Click Continue.
- Under Deprovisioning, select Hard delete user's account for each event, choose how long to wait, then click Continue.
- Optionally, test the connection, then click Finish. The test creates a real Ramp account for the user you select, then deactivates it. To skip the test, click Finish.
- On the app's details page, set Autoprovisioning to Active to start syncing users from Google to Ramp.
- In Ramp, click Finish on the setup page to go to the People page. Users appear after they sync to Ramp.
Important: Ramp doesn't apply Google suspensions. If you select only Suspend user's account for an event, the user keeps access to Ramp.
New users follow the invite preference in your SCIM settings. See how SCIM invite preferences control user creation.
How Google Workspace SCIM deactivates and reactivates users
When Google sends a Hard delete user's account request, Ramp deactivates the user instead of deleting their Ramp account. Draft users are deleted. To learn what deactivation means for a user's cards, funds, and workflows, see user termination via deactivation.
If Google provisions a deactivated user again, for example after you turn the app back on for them, Ramp reactivates their existing Ramp account when the user syncs.
To delete a pending SCIM invite, remove the user's access to Ramp in Google.
Disconnect Google Workspace SCIM
Disconnecting in Ramp stops future data syncing. To open the Disconnect option, see SCIM integration management. To fully disconnect, also go to the Google Admin console and delete the autoprovisioning configuration for Ramp.