Amazon

The Corma and Amazon integration covers the company's Amazon Business account: who can buy, approve, pay and administer purchases. Amazon Business provides purchasing solutions that let registered businesses and their employees shop for business supplies on Amazon, and the business account itself is free. AWS is a different service, covered on our AWS access management page.

Key takeaways

• The Amazon Business account is free, and Prime Business, its membership, has paid plans with a flat annual fee and a user limit, from 5 users on Essentials to unlimited on Enterprise.
• Amazon Business roles include Administrator, which bundles people, finance and tech permissions, plus separate Finance and Tech roles.
• Amazon Business members can add individual payment methods such as a corporate card, while administrators share company payment methods with groups.
• Amazon Business supports SAML 2.0 single sign-on, and SCIM provisioning for Okta and Azure identity providers.

Where does Amazon purchasing escape IT?

Business buying on Amazon can start outside the company account, a classic shadow IT pattern. Amazon recommends inviting users with a business email that is not already linked to an individual account, and Account Authority lets an organization consolidate the business accounts its buyers created. It can also tell employees who open a retail account with a verified company domain to use the business account instead.

Inside the business account, access is spread across roles and groups. Group-level administrators only manage the groups assigned to them, approval policies can run up to 6 levels, and Tech users manage domains, authentication methods, API keys and integrations. Every Prime Business plan except Enterprise has a user limit. Amazon does not document what happens to a removed user's order history or individual payment methods.

How Corma governs Amazon

• Leavers removed with a payment check: a leaver workflow in the IT Workflow Builder asks an Amazon Business administrator to remove the person from the business account and to check the individual payment methods they added.
• Admin and tech rights under review: Administrator, Finance and Tech roles, which control payments, reports, SSO and API keys, go into automated access reviews.
• Buyers on request: employees ask for a buyer account in the self-service app store, and a manager approves the group they join, which carries its own payment methods and approval policy.
• Membership in view: the Prime Business membership, its fee and its renewal sit in SaaS subscription management.

Frequently asked questions

Does Amazon Business support SSO and SCIM?

Yes. Amazon Business uses SAML 2.0 and names identity providers including Okta, Microsoft Azure, Microsoft ADFS, OneLogin, AWS SSO and Google G Suite. SCIM is available for Okta and Azure customers, automates onboarding, offboarding and group management, and is not supported for Punchout. Read what SCIM automates.

How does Corma connect to Amazon Business?

Through the Amazon Business APIs where they fit, although the User Management API only creates users, or through Corma's browser-based agents in the business account settings, in an isolated browser session.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want to know who can still buy on your company's Amazon account? Book a Corma demo.