6sense SCIM guide

Aha! Roadmaps, the product roadmapping platform, does not support SCIM provisioning on any plan. While Aha! offers SAML 2.0 SSO integration with identity providers like Okta, Entra ID, and OneLogin, this only handles authentication through JIT (Just-In-Time) provisioning. The critical limitation: JIT provisioning creates user accounts with no default role or access permissions, requiring administrators to manually configure access for each user after they first sign in. For product teams managing strategic roadmaps and stakeholder access, this creates significant operational overhead. Since product roadmaps contain sensitive strategic information and stakeholder access typically varies by product area, IT administrators must manually assign appropriate roles and workspace permissions after each user is provisioned. There's no automatic deprovisioning when users leave the organization, creating potential security gaps. This manual process becomes particularly problematic for larger product organizations where dozens of stakeholders across different business units need carefully managed access to specific roadmaps.

Appcues, the product adoption platform used by product managers and growth teams, explicitly does not support SCIM provisioning on any plan—not even Enterprise. While Appcues offers SAML 2.0 SSO integration starting at the Enterprise tier with just-in-time (JIT) provisioning, this only creates users during first login and provides no automated deprovisioning capabilities. For product teams where access needs change frequently as people move between projects or leave the company, this creates a significant security gap. The lack of SCIM means IT teams must manually manage user lifecycle for Appcues accounts, even though the platform handles sensitive product analytics and user flow data. When employees leave or change roles, their Appcues access remains active until manually revoked—a compliance risk that's particularly problematic given Appcues' role in tracking user behavior and product metrics. With MAU-based pricing starting at $300/month and scaling significantly with usage, paying for orphaned accounts also creates unnecessary cost bloat.

BambooHR does not support inbound SCIM provisioning on any plan. While BambooHR integrates with identity providers like Okta and Entra ID, it functions as the HR source of truth that provisions users TO other systems, not the other way around. This means your IdP cannot automatically create, update, or deactivate user accounts in BambooHR based on HR events or group membership changes. BambooHR offers SAML 2.0 SSO with JIT provisioning, but this only handles authentication for users who already exist in the system. This creates a significant operational gap for IT teams managing employee lifecycle automation. While BambooHR can push employee data to your IdP when HR makes changes, there's no way to automate the reverse flow - provisioning new users into BambooHR itself still requires manual account creation or CSV imports. For organizations where BambooHR isn't the primary HR system of record, this means maintaining dual data entry processes and accepting the compliance risks that come with manual provisioning workflows.