SCIM tax
The SCIM tax, and the tickets it creates.
The SCIM tax is paying extra, or being unable to pay at all, for automated user provisioning, so lifecycle changes in an app depend on a ticket instead of the directory.
As of October 2026, 178 of the 286 SaaS apps StitchOps tracks charge extra for SCIM.
Source and methodWhere vendors list both prices, the plan with SCIM costs a median of 2.1 times the plan most teams buy.
Source and method128 of the apps that gate SCIM sell that plan by quote only.
Source and method68 apps offer no SCIM at any price, so provisioning them stays manual without another way in.
Source and method
Data as of October 2026, from the SCIM Tax Index and sso.tax, checked by StitchOps.
Estimate your SCIM tax
Loading prices.
Expected scenario, list prices, SSO required, default department shares.
What it is
SCIM is the standard that lets a directory create, update, and remove users in an app automatically. Many vendors offer it only on their top plan. Many more never implement it. In both cases the joiner, mover, and leaver process for that app becomes a ticket that a person works by hand.
Why the tickets never clear
Every new app adds another console someone has to log into. Leavers are the dangerous case: the directory disables the user, but the app does not know, and access lingers for weeks. Access reviews then find what provisioning missed, by hand, before the audit.
Where identity platforms and legacy apps meet
Okta, Entra ID, and JumpCloud automate every app that offers SCIM or an API, and their integration networks keep growing. The gap sits in the apps themselves: vendor admin portals, industry systems and on premises thick clients that expose neither, or that sell SCIM only on their most expensive plan.
The most expensive SCIM taxes.
At 100 users, from listed prices, for a year.
| App | Plan most teams buy | Plan with SCIM | SCIM tax, 100 users |
|---|---|---|---|
| Salesforce | Starter Suite, $25 per user a month | Enterprise, $175 per user a month | $180,000 |
| HubSpot | Starter, $20 per user a month | Enterprise, $150 per user a month | $156,000 |
| Intercom | Essential, $29 per user a month | Expert, $132 per user a month | $123,600 |
| Copper CRM | Starter, $9 per user a month | Business, $99 per user a month | $108,000 |
| Freshservice | Starter, $19 per user a month | Pro, $99 per user a month | $96,000 |
| Front | Starter, $19 per user a month | Scale, $99 per user a month | $96,000 |
| Figma | Professional, $16 per user a month | Enterprise, $90 per user a month | $88,800 |
| Freshdesk | Growth, $19 per user a month | Enterprise, $89 per user a month | $84,000 |
| Pipedrive | Lite, $14 per user a month | Ultimate, $79 per user a month | $78,000 |
| Zendesk | Suite Team, $69 per user a month | Suite Professional, $115 per user a month | $55,200 |
What StitchOps does about it
Run it anyway.
StitchOps completes the lifecycle where SCIM stops. The directory event that already fires triggers a workflow. The agent on your worker VM makes the same change an admin would make in the app, with a vaulted credential and a confirmation gate before anything destructive. Evidence returns to the ticket, so the audit finds a log instead of a screenshot.
How StitchOps executes →Asked directly.
What is the SCIM tax?
The SCIM tax is paying extra, or being unable to pay at all, for automated user provisioning, so lifecycle changes in an app depend on a ticket instead of the directory.
How much does the SCIM tax cost?
Where vendors list both prices, the plan with SCIM costs a median of 2.1 times the plan most teams buy. At 100 users, the largest listed SCIM taxes are $180,000 a year for Salesforce, $156,000 a year for HubSpot, $123,600 a year for Intercom. The calculator estimates it for your own team and apps.
Which apps charge the SCIM tax?
As of October 2026, 178 of the 286 SaaS apps StitchOps tracks gate SCIM behind a more expensive plan, including Salesforce, HubSpot, Intercom. Another 9 support it only partly. The full list, with prices and sources, is on the SCIM pricing by app page.
How is the SCIM tax different from the SSO tax?
The SSO tax is the upcharge for single sign on; the SCIM tax is the upcharge for automated provisioning. Many vendors sell both on the same plan: in our data, SSO sits on the SCIM plan or above it for 91 of 187 apps that gate SCIM. When you need SSO anyway, that upgrade is not avoidable, and the calculator counts it that way.
Can you avoid the SCIM tax without upgrading?
For many apps, yes. StitchOps makes the same changes an admin would make in the app, on the plan you already have, triggered by the events your identity provider already sends. It uses an API when one exists and works anywhere a person can log in and act when one does not. Where you need SSO and the vendor sells it only on the SCIM plan, the upgrade stays.
Does StitchOps replace my identity provider?
No. Your identity provider decides who gets access and when it ends. StitchOps carries those decisions into the apps SCIM does not reach, and returns a record of every step.
How often is the SCIM tax data updated?
A scheduled job checks the SCIM Tax Index and sso.tax every month, and StitchOps rechecks vendors last verified more than 90 days ago. Every app shows its own verified date. Data as of October 2026.
Should we pay for SCIM when the vendor offers it?
Usually yes. A native SCIM connector is the right answer for any app that has one. StitchOps is for the apps that do not, or where the premium is out of proportion to the app.
How does the directory trigger StitchOps?
A webhook, a scheduled query, or your IGA tool calls the StitchOps workflow over the REST API with the user as a typed input. The same event that would have created a ticket runs the workflow instead.
What about apps with SCIM that does not cover roles?
Common. SCIM creates the user but the role or entitlement is set by hand. StitchOps sets the role the way an admin would, after the SCIM connector has created the account.
Start with one workflow that never had an API.
Fifteen minutes on your top three manual processes. We tell you which one to run first.