AdRoll SCIM guide

Automox offers native SCIM 2.0 provisioning, but only on their Enterprise plan with custom pricing. Lower tiers (Pro starting at $1/endpoint/month and Automate Essentials) are limited to JIT provisioning through SAML, which creates users only on first login with default Read Only permissions. This forces manual role adjustments for every new user and creates a gap between when access is granted in your IdP and when users can actually perform their job functions in Automox. The JIT-only approach on lower tiers creates compliance headaches for IT teams. Users appear "provisioned" in your identity provider but remain non-functional until they log in and administrators manually adjust their permissions. For patch management and endpoint security tools like Automox, this delay can leave critical systems unmanaged while you wait for manual intervention.

Coralogix supports native SCIM 2.0 provisioning on all paid plans (Business and Enterprise), but requires SSO configuration as a prerequisite. While this seems straightforward, Coralogix's custom pricing model means you'll need to negotiate directly with sales to understand the true cost of SCIM-enabled plans, creating procurement friction for what should be standard identity management functionality. The SSO-first requirement creates an additional deployment dependency that can complicate rollouts, especially in organizations where SCIM provisioning and SSO implementation are managed by different teams or have different timelines. This architectural coupling means you can't implement automated user lifecycle management without first configuring federated authentication, even if your immediate need is just provisioning automation.

Meta Ads supports SCIM 2.0 provisioning through Meta Work Accounts, which is free to access. However, Meta Work Accounts is currently only available to "select customers" - meaning most organizations can't access this functionality despite it being technically free. Even when available, SCIM only works with managed Meta Work Accounts, not personal Facebook profiles, creating a complex dual-account management scenario for many teams. This selective availability creates a significant operational gap. Without automated provisioning, IT teams must manually manage Meta Ads access for marketing teams, often dealing with personal Facebook accounts that can't be centrally controlled. When employees leave, their personal accounts retain access to company ad accounts and sensitive campaign data, creating compliance and security risks that SSO alone can't address.