Amazon Business cloud application

1.

In the Google Admin console, go to Menu AppsWeb and mobile apps.

You must be signed in as a super administrator for this task.

2. Click Add appSearch for apps. 3. Enter **Amazon Business** in the search field. 4. In the search results, hover over the **Amazon Business** SAML app and click **Select**. 5. On the **Google Identity Provider details** page, download the IdP metadata file. 6. Leave the Admin console open, you'll continue with the configuration wizard after performing the next step in the Amazon Business application.

*You must have a valid Amazon Business account for this task.* 1. At amazon.com, sign in to your Amazon Business account. 2. Click your account name at top right, then choose **Your Account** from the dropdown menu. 3. On your account profile page, click **Amazon Business settings**. 4. (Optional) Under **System integrations**, click **Domain verification** and follow the steps to add and verify your Google Workspace domain. 5. Under **System integrations**, select **Single Sign-On (SSO)**. 6. For **IDP Selected**, click **Change** and confirm. 7. From the **Change IDP Selection** list, select **Google gSuite** and click **Reset Configuration**. 8. For **Default Group**, select the default group and for **Default Buying Role**, select the role and click **Next**. 9. Locate and upload the Google IdP metadata XML file you downloaded in Step 1 above. The Entity ID, IssuerURL, Signing certificate, and HTTP-Redirect URL are automatically parsed from the XML file. 10. Click **Next**. 11. On the **Attribute Mapping** page, map Amazon attributes to SAML AttributeName values as follows:

Amazon data	SAML AttributeName
Email	email
First Name	firstName
Last Name	lastName

12. Click **Next**. 13. In **Amazon connection data**, copy the **SSO URL.** You'll need this when you complete the Google-side configuration in Admin console in step 3 below.

1. Return to the Admin console browser tab. 2. On the **Google Identity Provider details** page, click **Continue**. 3. On the **Service provider details** page, replace the **ACS URL** with the SSO URL you copied from Amazon Business SSO settings at the end of Step 2 above. 4. Update the **Entity ID** for your region. For example, for North America, use **https://www.amazon.com**. For Japan, use **https://www.amazon.jp**. For Europe, use **https://www.amazon.de**. 5. Click **Continue**. 6. On the **Attribute Mapping** page, click the **Select field** menu and map the following Google directory attributes to their corresponding Amazon Business attributes. Note that firstName, lastName, and email are required attributes.

Google directory attribute	Amazon Business attribute
Basic Information > Primary Email	email
Basic Information > First Name	firstName
Basic Information > Last Name	lastName

7. (Optional) Click **Add Mapping** to add any additional mappings you need. 8. (Optional) To enter group names that are relevant for this app:

1. For Group membership (optional), click Search for a group, enter one or more letters of the group name, and select the group name.
2. Add additional groups as needed (maximum of 75 groups).
3. For App attribute, enter the corresponding groups attribute name of the service provider.

Regardless of how many group names you enter, the SAML response includes only groups that a user is a member of (directly or indirectly). For more information, go to About group membership mapping.

9. Click **Finish**.

1.

In the Google Admin console, go to Menu AppsWeb and mobile apps.

You must be signed in as a super administrator for this task.

2. Select **Amazon Business**. 3. Click User access. 4.

To turn a service on or off for everyone in your organization, click On for everyone or Off for everyone, and then click Save.

5. (Optional) To turn a service on or off for an organizational unit:

1. At the left, select the organizational unit.
2. To change the Service status, select On or Off.
3. Choose one:
   • If the Service status is set to Inherited and you want to keep the updated setting, even if the parent setting changes, click Override.
   • If the Service status is set to Overridden, either click Inherit to revert to the same setting as its parent, or click Save to keep the new setting, even if the parent setting changes.
     Learn more about organizational structure.

6. (Optional) To turn on a service for a set of users across or within organizational units, select an access group. For details, go to Customize service access using access groups.

Amazon Business supports both Identity Provider (IdP) initiated and Service Provider (SP) initiated SSO. Follow these steps to verify SSO in either mode: **IdP-initiated** 1.

In the Google Admin console, go to Menu AppsWeb and mobile apps.

You must be signed in as a super administrator for this task.

2. Select **Amazon Business**. 3. At the top left, click **Test SAML login**. Amazon Business should open in a separate tab. If it doesn't, use the information in the resulting SAML error messages to update your IdP and SP settings as needed, then retest SAML login. **SP-initiated** 1. In Amazon, go to the **SSO Connection** **Details** page. 2. In the **Status** section, click **Start Testing**. 3. Click **Test**. A new browser window opens that redirects you to Google for authentication. 4. Sign in as a Google user who has access to your Amazon Business account. 5. Verify the following: * The user account is successfully signed in to Amazon Business. * The SP-initiated URL and the IdP-initiated URL both display on the **SSO Connection Details** page. 6. Click **Activate** when you're ready to make the SP initiated URL available to your users.