Summary and recommendation
Google Analytics does not support native SCIM provisioning at the application level. While GA4 360 customers can leverage SCIM through Google Cloud Identity at the organization level, this creates a fundamental gap: SCIM provisions Google accounts broadly, but Google Analytics access requires property-level permissions that must be managed separately within the GA interface. Even with Google Cloud Identity SCIM in place, IT admins still face manual property access assignments, role management, and the complexity of coordinating between Google Workspace provisioning and GA-specific permissions.
This layered approach creates operational overhead and compliance risks. When employees join, leave, or change roles, their Google Analytics access may persist even after their broader Google account is deprovisioned, since property permissions are managed independently. For organizations using non-Google identity providers, the challenge is compounded—they must maintain federation between their IdP and Google Cloud Identity, then separately manage GA property access.
The strategic alternative
Google Analytics has no native SCIM. That leaves a workflow gap in offboarding, access reviews, and license cleanup unless your team handles the app another way. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | No |
| SCIM tier required | N/A |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | Google SSO / SAML via Cloud Identity |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | Via third-party | ❌ | GA access is via Google accounts. Okta can provision to Google Workspace/Cloud Identity (which then grants GA access). No direct GA SCIM endpoint. |
| Microsoft Entra ID | Via third-party | ❌ | GA access managed via Google accounts. Entra ID can federate/sync with Google Cloud Identity. No direct GA provisioning - manage at Google org level. |
| Google Workspace | Via third-party | ❌ | No native support |
| OneLogin | Via third-party | ❌ | No native support |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Google Analytics accounts manually. Here's what that costs:
The Google Analytics pricing problem
Google Analytics gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| GA4 Standard | Free | ||
| GA4 360 | $50,000+/year |
Pricing structure
| Plan | Price | SCIM |
|---|---|---|
| GA4 Standard | Free | ❌ Not available |
| GA4 360 | $50,000+/year | ✓ Via Google Cloud Identity |
Google Analytics access model
What this means in practice
For most organizations using GA4 Standard (free)
For GA4 360 customers ($50K+/year)
Additional constraints
Summary of challenges
- Google Analytics does not provide native SCIM at any price tier
- Organizations must rely on third-party tools or manual provisioning
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Google Analytics actually offers for identity
SAML SSO (via Google Cloud Identity)
Google Analytics access is managed through Google accounts, with enterprise SSO handled at the Google Cloud organization level:
| Setting | Details |
|---|---|
| Protocol | SAML 2.0 via Google Cloud Identity |
| Supported IdPs | Okta, Entra ID, OneLogin, other SAML providers |
| Configuration | Set up federation at Google Cloud org level |
| User requirement | Google accounts required for GA access |
Critical limitation: You're not configuring SSO for Google Analytics directly. You're federating with Google Cloud Identity, which then grants access to GA properties based on Google account permissions.
SCIM Provisioning (Google Cloud Organization Level)
| Feature | Supported? |
|---|---|
| Direct GA SCIM endpoint | ❌ No |
| Google Cloud Identity SCIM | ✓ Yes (with Google Workspace/Cloud Identity) |
| Property-level provisioning | ❌ No |
| Role-based access control | ✓ Yes (via GA property permissions) |
| Automatic deprovisioning | ✓ Yes (at Google account level) |
The real challenge: SCIM works at the Google Cloud organization level, not within Google Analytics itself. You can provision Google accounts, but managing property-level access within GA still requires manual configuration.
What this means for IT teams
What IT admins are saying
Community sentiment on Google Analytics's provisioning reveals frustration with the indirect access model:
- Google account dependency - All GA access requires Google accounts, forcing organizations into Google's identity ecosystem
- Organizational complexity - SCIM works at the Google Cloud organization level, not for specific GA properties
- Property-level permission gaps - Managing granular access to different GA properties requires manual coordination
- Mixed identity requirements - Teams need both Google Workspace/Cloud Identity AND separate GA property permissions
Access via Google accounts. Enterprise SSO via Google Cloud Identity with third-party IdP SAML.
SCIM at Google Cloud organization level, not GA-specific.
The recurring theme
Google Analytics forces a two-tier access model where IT teams must manage both Google Cloud organization membership AND individual GA property permissions, creating ongoing manual work even with SCIM configured at the organizational level.
The decision
| Your Situation | Recommendation |
|---|---|
| Small marketing team (<10 users) with Google Workspace | Manual Google account management is acceptable |
| Mixed IdP environment (Okta/Entra + Google accounts) | Use Stitchflow: eliminates Google account friction |
| Enterprise with multiple GA properties and strict access controls | Use Stitchflow: automation essential for property-level governance |
| Large organization (50+ analysts) needing GA access | Use Stitchflow: automation strongly recommended |
| Compliance requirements with audit trails for analytics access | Use Stitchflow: automation essential for complete audit history |
The bottom line
Google Analytics has no native SCIM. That means one more workflow gap in offboarding, access reviews, and license cleanup unless your team handles it another way.
Close the Google Analytics workflow gap
Google Analytics is one gap in a broader workflow. Stitchflow builds and maintains the offboarding, access review, or license workflow across every app in your environment.
Technical specifications
SCIM Version
Not specifiedSupported Operations
Not specifiedSupported Attributes
Plan requirement
Not specifiedPrerequisites
Not specifiedKey limitations
- Access via Google Account/Workspace
- SCIM at Google Cloud organization level
- Property-level permissions in GA
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app
Where to enable
Docs
GA access is via Google accounts. Okta can provision to Google Workspace/Cloud Identity (which then grants GA access). No direct GA SCIM endpoint.
Use Stitchflow for automated provisioning.
Close the workflow gap in
Google Analytics
Google Analytics has no native SCIM. That leaves one more workflow gap in offboarding, access reviews, and license cleanup unless your team handles it another way.
Start with the free gap diagnostic


