Avalara

The Corma and Avalara integration keeps access to AvaTax in line with the finance and tax teams who rely on it. Avalara's pricing page describes AvaTax as AI-powered, real-time tax calculation across 12,000+ U.S. tax jurisdictions, and Vista Equity Partners completed its acquisition of Avalara on October 19, 2022. Pricing depends on products, integrations, transaction volume and states, with no mention of seats, so governance is about who can change tax settings and which keys connect your systems.

Key takeaways

• The current AvaTax roles article lists Account Administrator, Account Viewer and No access, with access granted to the whole account or to specific companies.
• An AvaTax user is removed by making them inactive in Account > Users and admins, after which they cannot sign in.
• Avalara supports SAML 2.0 single sign-on with identity providers such as Okta and Microsoft Entra ID, set up by an Account or Organization administrator.
• Avalara license key authentication is not user-specific, keeps working when a user resets their password, and cannot identify the individual user acting.

Why does the Avalara license key need an owner?

The license key is an account credential, not a personal one. Avalara's integration guide confirms that license key authentication cannot identify the individual user acting, and keeps working when one user resets their password. Avalara does not store license keys and documents no expiry for them. Resetting a license key cannot be undone: the previous key stops working immediately, and every business application connected with that key stops until it is updated.

Avalara's pages disagree on how many keys an account holds. An older integration guide says each AvaTax account has one, and only one, license key, while the current license key article describes a default key plus secondary keys for individual integrations. Only account administrators can reset the default key. For audits, the ExportAuditLogs API exports records of configuration changes, including the USER table.

How Corma governs Avalara

• Administrators under review: Account Administrators, who can create users, make them inactive and reset the default license key, go into automated access reviews.
• Leavers made inactive: a leaver workflow in the IT Workflow Builder asks an Account Administrator to make the person inactive and to check whether they kept a copy of a license key that should be reset.
• License keys with an owner: default and secondary license keys are non-human identities, so each one needs a named owner and a record of the integration it connects.
• Contract in view: the Avalara subscription and its renewal date sit in SaaS subscription management, shared with the finance team.

Frequently asked questions

Does Avalara support SSO and SCIM?

Avalara supports SAML 2.0 only, with IdP-initiated and SP-initiated sign-in, and names Okta, Microsoft Entra ID, Azure AD and Oracle IDCS or OCI IAM as identity providers. Once domains are verified, administrators can exclude specific users from SSO. Avalara documents no SCIM provisioning and no plan requirement for SAML. MFA can be Required for all users or Opt-in. Read what SAML covers.

How does Corma connect to Avalara?

Through the AvaTax REST API where it fits, which can create users and mark them as deleted, or through Corma's browser-based agents in Account > Users and admins. See also how Corma covers tax tools such as Anrok.

Where is Corma data hosted?

Corma runs on AWS, with web servers and databases in data centers inside the European Union. Data is encrypted in transit and at rest, and Corma is ISO/IEC 27001:2022 certified.

Want a named owner for every Avalara license key? Book a Corma demo.