How to automate user provisioning without upgrading every app to its SCIM plan
Keep SCIM where your plan already includes it, and automate the rest on the plans you have. Sort your apps into three groups: SCIM included, SCIM only on a higher plan, and no SCIM at all. Your identity provider handles the first group. StitchOps carries the same joiner, mover and leaver events into the other two, so you only upgrade where you need the higher plan for something else.
Last updated
1. List your apps and who gets them
Start with every app you pay for and which departments use it. A spreadsheet is fine. The SCIM tax calculator can import it, or start from its template.
2. Sort each app into three groups
For each app, find out whether your current plan includes SCIM, whether SCIM needs a higher plan, or whether no plan offers it. SCIM pricing by app shows this for each app we track, with a link to the vendor's pricing page and the date we last checked it.
3. Check where SSO sits
Many vendors sell SSO and SCIM on the same plan. If you need SSO in that app, the upgrade is not optional, so use its SCIM as well. Where SSO sits on a cheaper plan than SCIM, only the difference is the SCIM tax.
4. Keep SCIM where it is included, automate the rest
Your identity provider keeps provisioning every app that includes SCIM on your plan. For the apps where SCIM costs extra or does not exist, StitchOps makes the same changes an admin would make, triggered by the hires, moves and departures your identity provider already sees. It uses an API when one exists and works anywhere a person can log in and act when one does not.
5. Use renewals to move back
If you already pay for a higher plan only to get SCIM, note the renewal month. At renewal you can move back to the plan that fits how you use the app, once its accounts are automated another way.
6. Keep the record
Every account StitchOps creates, changes or removes leaves a record of each step. That is the evidence an access review or audit asks for.