Summary and recommendation
Aha! Roadmaps, the product roadmapping platform, does not support SCIM provisioning on any plan. While Aha! offers SAML 2.0 SSO integration with identity providers like Okta, Entra ID, and OneLogin, this only handles authentication through JIT (Just-In-Time) provisioning. The critical limitation: JIT provisioning creates user accounts with no default role or access permissions, requiring administrators to manually configure access for each user after they first sign in.
For product teams managing strategic roadmaps and stakeholder access, this creates significant operational overhead. Since product roadmaps contain sensitive strategic information and stakeholder access typically varies by product area, IT administrators must manually assign appropriate roles and workspace permissions after each user is provisioned. There's no automatic deprovisioning when users leave the organization, creating potential security gaps. This manual process becomes particularly problematic for larger product organizations where dozens of stakeholders across different business units need carefully managed access to specific roadmaps.
The strategic alternative
Stitchflow provides managed provisioning automation for Aha! Roadmaps without requiring any custom development work. Works regardless of your Aha! plan. Flat pricing under $5K/year, regardless of team size.
Quick SCIM facts
| SCIM available? | No |
| SCIM tier required | N/A |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | Via third-party | ❌ | SSO only - no SCIM provisioning. JIT creates users with no default role/access. Administrators must manually set roles after provisioning. |
| Microsoft Entra ID | Via third-party | ❌ | SSO via SAML. JIT provisioning creates users with no access. ProductPrefix/ProductRole attributes can provision users to specific workspaces. Requires Entra admin and Aha! admin. |
| Google Workspace | Via third-party | ❌ | No native support |
| OneLogin | Via third-party | ❌ | No native support |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Aha! accounts manually. Here's what that costs:
The Aha! pricing problem
Aha! gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Premium | $59/user/month | ||
| Enterprise | $99/user/month (annual) | ||
| Enterprise+ | $149/user/month (annual) |
Pricing structure
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Premium | $59/user/month | ||
| Enterprise | $99/user/month (annual) | ||
| Enterprise+ | $149/user/month (annual) |
Note: All Enterprise plans include unlimited reviewers/viewers
What this means in practice
Without SCIM, Aha! forces IT admins into a manual workflow that defeats the purpose of automated provisioning:
1. JIT creates security gaps: When users authenticate via SSO, Aha! automatically creates accounts with no assigned role or workspace access 2. Manual role assignment required: Admins must log into Aha! after each new user signs in to manually configure their permissions and workspace assignments 3. No automated deprovisioning: Terminated employees retain access until manually removed from each Aha! account
For a 50-person product team, this means potentially dozens of manual interventions per quarter just for basic user lifecycle management.
Additional constraints
Summary of challenges
- Aha! does not provide native SCIM at any price tier
- Organizations must rely on third-party tools or manual provisioning
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Aha! actually offers for identity
SAML SSO (Enterprise and Enterprise+ plans)
Aha! supports SAML 2.0 integration but no native SCIM provisioning:
| Setting | Details |
|---|---|
| Protocol | SAML 2.0 |
| Supported IdPs | Okta, Entra ID, OneLogin, PingIdentity, generic SAML |
| JIT Provisioning | ✓ Yes (creates accounts automatically) |
| Role Assignment | Manual - admins must configure after user creation |
| Deprovisioning | Manual only |
Critical limitation: JIT provisioning creates users with no default role or workspace access. Administrators must manually assign roles and permissions after each user's first login.
IdP Integration Reality Check
| IdP | SSO | SCIM Provisioning | User Management |
|---|---|---|---|
| Okta | ✓ SAML | ❌ No | Manual via JIT |
| Entra ID | ✓ SAML | ❌ No | Manual via JIT |
| OneLogin | ✓ SAML | ❌ No | Manual via JIT |
| Google Workspace | ✓ SAML | ❌ No | Manual via JIT |
The Enterprise Plan Reality
At $99-149/user/month, you're paying for:
The problem: Teams looking for automated user provisioning get expensive roadmapping features they may not need, while still requiring manual role management after JIT provisioning.
What's Missing
SCIM provisioning is a requested feature but not available. Current gaps include:
What IT admins are saying
Aha!'s lack of SCIM support creates ongoing friction for IT teams managing product management tools:
The community has been vocal about this gap: "SCIM provisioning is a requested feature" according to Aha!'s own documentation, with an active feature request (A-I-12570) highlighting the demand.
- No automated user provisioning - all accounts must be manually created
- JIT provisioning creates users with no default roles or access permissions
- Administrators must manually configure workspace access after each login
- No automated deprovisioning when employees leave the organization
No SCIM means manual user management
JIT creates accounts anyone in IdP can access
The recurring theme
Even with SSO configured, IT teams face a two-step process - users can authenticate, but administrators must manually assign roles and workspace access after every new login. For product teams handling sensitive roadmaps and strategic plans, this creates both security risks and administrative overhead.
The decision
| Your Situation | Recommendation |
|---|---|
| Small product team (<20 users) with low turnover | Manual management with SSO authentication is workable |
| Growing product organization (30+ users) | Use Stitchflow: JIT creates security gaps without role automation |
| Enterprise with multiple product lines | Use Stitchflow: manual role assignment doesn't scale |
| Organizations with compliance requirements | Use Stitchflow: audit trail essential for strategic roadmap access |
| Teams with frequent stakeholder changes | Use Stitchflow: automation prevents orphaned accounts with roadmap access |
The bottom line
Aha! Roadmaps contains your most strategic product information, but its JIT provisioning creates users with no default access controls—admins must manually assign roles after every new user login. For product teams that need secure, scalable access management without the operational overhead, Stitchflow automates the entire workflow.
Automate Aha! without third-party complexity
Stitchflow delivers SCIM-level provisioning through resilient browser automation, backed by 24/7 human in the loop for Aha! at <$5K/year, flat, regardless of team size.
Technical specifications
SCIM Version
Not specifiedSupported Operations
Not specifiedSupported Attributes
Plan requirement
Not specifiedPrerequisites
Not specifiedKey limitations
- No native SCIM support (feature request exists)
- JIT provisioning creates users with no default role/access
- Administrators must manually set roles after provisioning
- Custom attributes via ProductPrefix/ProductRole for role mapping
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Docs
SSO only - no SCIM provisioning. JIT creates users with no default role/access. Administrators must manually set roles after provisioning.
Use Stitchflow for automated provisioning.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
SSO via SAML. JIT provisioning creates users with no access. ProductPrefix/ProductRole attributes can provision users to specific workspaces. Requires Entra admin and Aha! admin.
Use Stitchflow for automated provisioning.
Unlock SCIM for
Aha!
Aha! doesn't offer SCIM. Get an enterprise-grade SCIM endpoint in your IdP, even without native support.
See how it works