15Five SCIM guide

Dropbox Business supports SCIM 2.0 provisioning on Standard plans and above ($15/user/month), with solid integration across major identity providers including Okta, Azure AD, and Google Workspace. However, there's a critical architectural limitation: Dropbox Sign (formerly HelloSign) operates as a separate product that doesn't support SCIM at all, despite being a core part of many organizations' document workflows. This creates a significant provisioning gap for IT teams. While your main Dropbox storage accounts can be automatically managed, any users who need access to Dropbox Sign must be manually provisioned and deprovisioned. For organizations relying on both products, this means maintaining hybrid workflows where some users are automated and others require manual intervention—exactly the kind of inconsistency that leads to compliance issues and security gaps during employee transitions.

Atlassian Jira Service Management supports SCIM 2.0 for provisioning both support agents and customers, but only with an Atlassian Guard Standard subscription on top of your existing JSM plan. This means paying for two separate subscriptions: JSM ($20-57/agent/month) plus Guard for SCIM functionality. For enterprise teams with 201+ agents, this often results in six-figure annual costs just to enable automated provisioning. The dual subscription model creates significant budget friction for IT teams who need basic user lifecycle management. Without SCIM, you're manually managing agent accounts and customer portal access, creating security gaps when employees change roles or leave. JSM's customer provisioning complexity—requiring specific product access roles and organization mapping—makes manual management even more error-prone for large service desk operations.

AWS IAM Identity Center supports SCIM 2.0 provisioning and is completely free—no additional licensing costs beyond your AWS account. However, the implementation has significant operational limitations that create ongoing management overhead for IT teams. The core issues: SCIM sync runs every 20-40 minutes (not real-time), multivalue attributes aren't supported, and once SCIM is enabled, you lose the ability to manually manage users through the AWS console. More problematic, Azure AD users face nested group limitations and attribute removal sync issues, while all IdPs must work around the requirement for specific mandatory fields (First name, Last name, Username, Display name). For organizations managing complex AWS multi-account environments with varying permission sets, these constraints force manual workarounds that undermine automation benefits. While IAM Identity Center's free pricing is attractive, the operational friction from sync delays, attribute limitations, and console lockout creates hidden administrative costs—especially when managing hundreds of users across multiple AWS accounts with different access requirements.