SCIM Is the Wire That Closes an Account When Someone Leaves
SCIM lets your identity directory create and switch off accounts inside another application automatically. Hire someone and the accounts appear, remove them from the directory and the accounts close without anyone filing a ticket.
It is not only an enterprise feature. Slack lists SCIM user management on its Pro plan at $7.25 per user monthly with annual billing as of Aug 2026, which sits well below what many buyers expect to pay for it.
The value shows up on the way out rather than the way in. Ten forgotten seats at $15 each quietly cost $1,800 a year, and a forgotten account is also the one nobody remembered to close.
Single Sign On and Provisioning Solve Two Halves of One Problem
- ● SSO - who can log in now
- ● SCIM - which accounts exist
- ● Local passwords survive both
Single sign on answers a question about this moment. When someone clicks log in, it checks with your directory and either lets them through or does not.
SCIM answers a question about existence. It decides whether an account is there at all, which fields it carries and whether it stays active.
The gap between the two is where offboarding fails. An application can honour your sign on and still keep a local password login, so removing the person from the directory blocks one door and leaves another open.
That is the scenario worth testing before you trust any setup. Disable a test user in your directory, then try every login path the app offers rather than only the sign on button.
Which Familiar Plans Include It and at What Price
Feature grids place provisioning at wildly different tiers, so the assumption that it lives behind a sales call is often wrong. Here is where it lands on plans most small teams already know.
| Product and plan | Price per user monthly as of Aug 2026 | Provisioning position | Worth noting |
|---|---|---|---|
| Slack Pro | $8.75 monthly, $7.25 annual | SCIM user management included | SAML sign on included at this tier too |
| Slack Business Plus | $18 monthly, $15 annual | SCIM user management included | Adds administrative controls rather than provisioning |
| Google Workspace Starter | $7.00 flexible | Directory is the source, 30 GB per user | Starter, Standard and Plus cap at 300 users |
| Google Workspace Plus | $22.00 | Adds secure LDAP and advanced endpoint management | 5 TB per user |
| Okta Starter | $6.00 billed annually | Sign on and multifactor, no lifecycle management | $1,500 annual contract minimum |
| Okta Essentials | $17.00 billed annually | Lifecycle management included | The tier where automated provisioning arrives |
Prices come from the published Slack, Google Workspace and Okta pricing pages as of Aug 2026. Confirm current pricing on the official site, since tiers and feature placement in this category change more often than headline prices do.
Two things stand out in that table. A collaboration tool can hand you provisioning at $7.25 per user, while the identity platform that connects everything together charges $17 per user for the same category of capability.
So the expensive part is rarely the application. It is the directory layer that has to sit in the middle, plus the $1,500 annual minimum that comes with it.
The Cost of Skipping It Is Paid in Seats Nobody Cancelled
- ● 10 idle seats at $15
- ● $150 a month wasted
- ● $1,800 a year
Manual offboarding fails quietly. Nothing breaks on the day someone leaves, so the missing step only surfaces on an invoice months later.
The arithmetic is unforgiving at small scale. Ten stale seats across a stack priced at $15 each cost $150 a month, and nobody notices $150 in a bill that also contains real usage.
Per user pricing makes this worse than it looks. Our breakdown of per user against flat rate pricing covers why headcount based billing punishes exactly this kind of drift.
The fix without SCIM is a calendar entry. Our guide to auditing subscriptions and cutting wasted seats sets out a quarterly pass that recovers most of the same money.
Deprovisioning Is the Half That Actually Matters
Creating accounts is convenient. Closing them is the part that shows up in a security questionnaire, and it is the reason auditors ask about provisioning at all.
An account that outlives its owner is a standing risk. It keeps whatever access it had, it rarely has multifactor enforced any more, and nobody is watching its login history.
Contractors make the problem sharper. Short engagements produce accounts with end dates that never get honoured, a case we cover in whether contractors and clients need paid seats.
Buyers who care about this usually meet it through compliance reviews. Our explainer on what SOC 2 compliance means for small business software covers where access control sits in that process.
What Automatic Provisioning Will Not Do for You
- ● Permissions may not sync
- ● Unsupported apps stay manual
- ● Data is kept, not deleted
Provisioning creates and closes accounts. It does not guarantee that permissions inside the application follow the same rules, and group mapping is often a separate configuration with its own gaps.
Coverage is uneven across a real stack. The small tools a team adopts on its own frequently have no support at all, so a directory driven process still leaves a manual list beside it.
Closing an account is also not deleting data. Files, messages and history usually remain under the organisation, which is what you want for continuity and worth knowing before someone assumes otherwise.
Test the whole path rather than the setup screen. Provisioning that was configured once and never verified fails silently, and the failure only appears when someone still has access they should not.
How the Sync Runs Once It Is Switched On
Your directory holds the master record and pushes changes outward. Applications do not poll for news, so nothing happens in them until the directory decides something changed.
Group membership usually drives the whole thing. Put someone in the designers group and the design tools create their accounts, move them to another group and the first set closes.
Name and role changes travel the same way. A married name or a new job title updates centrally and appears in each connected app, which removes a category of small admin tasks nobody enjoys.
Timing is not always instant. Some connectors push changes immediately while others run on a schedule, and knowing which kind you have matters on the day you need an account closed within the hour.
The Manual Process That Works Until It Does Not
Small teams can match most of this without buying anything. The requirement is a written list rather than a memory, and the list has to live where the person doing offboarding will find it.
Keep one document naming every tool, who administers it and where its billing sits. Adding a tool means adding a line, which is the only discipline the whole system needs.
On someone leaving, work the list top to bottom and close rather than downgrade. A suspended account often still occupies a paid seat, so the invoice does not move until the seat is actually released.
Then check the next invoice against the list. Billing is the honest record of what you are still paying for, and a quarterly comparison catches whatever the checklist missed.
This breaks down at a predictable point. Once tools outnumber the people who remember them, or turnover outpaces the checklist, the automation stops being a luxury.
Which Provisioning Setup Fits Your Team Size
Under ten people: Skip it. A written offboarding checklist and a quarterly seat review cost nothing and work reliably when one person can hold the whole stack in their head.
Ten to fifty people with steady headcount: Use whatever comes bundled. Slack style plans that include SCIM at $7.25 per user let you connect the tools that matter without buying an identity platform.
Teams with heavy turnover or many contractors: This is where the identity layer earns its price. Okta Essentials at $17 per user includes lifecycle management, and the $1,500 annual minimum is the real entry cost to weigh.
Regulated or client audited businesses: Buy it for the evidence as much as the automation. Being able to show that access ends automatically answers a question that comes up in every security review.
Anyone consolidating a sprawling stack: Fix the inventory before the plumbing. Provisioning applied to tools you should have cancelled just automates the wrong thing more efficiently.
Questions Worth Asking Before You Sign
Ask which plan includes provisioning rather than whether the product supports it. Support is nearly universal, and placement in the feature grid is what decides your bill.
Ask what happens to local logins when the directory entry disappears. A vendor who answers that question precisely has thought about offboarding, and one who talks only about sign on has not.
Then ask what provisioning covers beyond account existence. Group membership, role mapping and licence tiers are the details that decide whether the automation removes work or simply moves it.
The Short Version Worth Remembering
SCIM keeps the list of who has an account in step with the list of who works here. Single sign on cannot do that job, and manual processes do it right until the week they do not.
Check the price of the tier before assuming the feature is out of reach. It sits at $7.25 per user in one familiar product and behind a $1,500 annual minimum in another.
Then judge it against the cost of drift. If forgotten seats and lingering access already cost more than the tier upgrade, the decision has effectively made itself.
FAQ
What does SCIM do in a business application?
SCIM is a standard that lets your identity directory create, update and switch off accounts inside another application automatically. Add someone to the right group and their accounts appear, remove them and the accounts close.
Is SCIM the same thing as single sign on?
No. Single sign on decides who can log in right now, while SCIM decides which accounts exist at all. An app can accept your sign on and still keep a local account that survives after you remove the person from the directory.
Do I need an enterprise plan to get SCIM?
Not always. Slack lists SCIM user management on its Pro plan at $7.25 per user monthly with annual billing as of Aug 2026, while other vendors reserve it for a higher tier. Check the feature grid rather than assuming.
What goes wrong without automatic provisioning?
Forgotten seats and lingering access. Ten unused seats at $15 each cost $1,800 a year, and an account nobody closed is the one an ex employee still signs into months later.
At what team size is automatic provisioning worth paying for?
Around the point where manual offboarding stops being reliable, which is usually a few dozen people or a high turnover team. Below that, a written checklist and a quarterly seat audit do the same job for nothing.
Sources
- RFC 7644: System for Cross-domain Identity Management: Protocol — checked 2026-10-01
- Slack Pricing Plans: Find the Right Fit for Your Team | Slack — checked 2026-10-01
Some links may be affiliate links. We may earn a commission at no extra cost to you.
How this article was made: it was drafted with AI assistance from the official sources listed above, and its figures were checked against those pages on the dates shown. It is not based on personal hands-on testing.
Comments
Post a Comment