>Google's provisioning and management systems are so far the best
So far my experience with that is trying to get an Active Directory server to sync with Google Apps for Education, for which they provide this tool:
https://support.google.com/a/answer/6027781?hl=en
It's beyond buggy, it's plain broken. It clearly hasn't been touched in years. I'm going to have to write the glue code myself.