Stitchflow
Airbyte logo

Airbyte SCIM guide

Native SCIM

How to automate Airbyte user provisioning, and what it actually costs

Native SCIM requires Enterprise or Cloud Team/Enterprise plan

Summary and recommendation

Airbyte supports SCIM provisioning, but only on Enterprise plans with custom pricing. While their Cloud plan starts at $10/month plus usage credits, SCIM access requires jumping to Enterprise—a significant cost leap that puts automated provisioning out of reach for most data teams. This creates a problematic gap where data engineers get SSO access through OIDC, but IT teams must manually provision and deprovision accounts in a platform that handles sensitive data source connections.

The stakes are particularly high with data integration platforms. Data engineers need timely access to build and maintain pipelines, but manual provisioning delays create bottlenecks. More critically, when engineers leave or change roles, manual deprovisioning risks leaving active accounts with access to production databases, APIs, and other sensitive data sources—a compliance and security nightmare.

The strategic alternative

Airbyte gates SCIM behind Enterprise or Cloud Team/Enterprise. Skip the Enterprise or Cloud Team/Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredEnterprise
SSO required first?Yes
SSO available?Yes
SSO protocolOIDC (OpenID Connect)
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDGallery app with SCIM
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Airbyte accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Airbyte pricing problem

Airbyte gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Plan Structure

PlanPriceSSOSCIM
Cloud$10/mo + usage credits
PlusAnnual (contact sales)
TeamsCapacity-based (contact sales)
EnterpriseCustom pricing

Note: Enterprise is the only tier that includes both SSO and SCIM provisioning. SSO uses OpenID Connect (OIDC) protocol exclusively - no SAML support.

What this means in practice

The Enterprise requirement forces organizations into custom pricing negotiations even for basic provisioning capabilities. This creates several cost scenarios:

For growing data teams: Moving from Cloud ($10/mo + credits) to Enterprise typically represents a 10-20x cost increase, as Enterprise pricing starts in the thousands per month range.

For self-hosted deployments: Enterprise is required for any SSO/SCIM functionality, making it impossible to use identity management with Airbyte's open-source version alone.

Usage-based uncertainty: The new credit system ($2.50/credit, with API sources at $15/million rows and database sources at $10/GB) makes it difficult to predict total Enterprise costs for provisioning-enabled deployments.

Additional constraints

OIDC-only authentication
No SAML support limits compatibility with some enterprise identity providers that prefer SAML workflows.
Self-hosted complexity
Enterprise customers using self-hosted Airbyte face additional deployment overhead for SSO configuration compared to cloud deployments.
Data sensitivity requirements
Data engineering teams often need rapid provisioning due to the sensitive nature of database connections and API credentials they manage.
No seat minimums published
Unlike other Enterprise tools, Airbyte doesn't publish minimum seat requirements, forcing custom negotiations for every provisioning implementation.

Summary of challenges

  • Airbyte supports SCIM but only at Enterprise tier (Custom)
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

Airbyte doesn't sell SCIM à la carte. It's bundled with Enterprise features that most data teams don't need:

SCIM automated provisioning
OIDC single sign-on (no SAML support)
Self-hosted and hybrid deployment options
Advanced security compliance (SOC 2, HIPAA, ISO 27001)
Custom SLAs and dedicated support
Advanced monitoring and observability
Multi-workspace management
Custom connector development support

Stitchflow Insight

The pricing jump is significant—from $10/month + usage credits on Cloud to custom Enterprise pricing that typically starts in the tens of thousands annually. If you're running standard data pipelines and just need user provisioning, you're paying for enterprise infrastructure features you'll never use. We estimate ~80% of Enterprise features are overkill for teams that simply want automated user management for their data integration workflows.

What IT admins are saying

Community sentiment on Airbyte's SCIM limitations centers around unnecessary complexity and enterprise gatekeeping. Common complaints:

  • Enterprise pricing required just to get basic identity automation
  • OIDC-only authentication limits integration flexibility
  • Self-hosted deployments still waiting for promised SSO features
  • Data pipeline access controls feel half-baked compared to competitors

Why do I need Enterprise just for SSO? We're a small data team that doesn't need all the other enterprise features.

Reddit r/dataengineering

OIDC-only is limiting when our org standardized on SAML everywhere else. Now Airbyte is the exception.

Hacker News

The recurring theme

Basic identity features are locked behind enterprise tiers, forcing data teams to overpay for provisioning automation or manage user access manually in a tool that handles sensitive data connections.

The decision

Your SituationRecommendation
On Cloud or Plus, need SCIMUse Stitchflow: avoid the Enterprise tier jump and custom pricing
Already on Enterprise planUse native SCIM: you're paying for it
Need Enterprise features beyond SCIMEvaluate Enterprise: SCIM comes bundled with self-hosted options
Small data team, low employee churnManual may be tolerable: but monitor for data access gaps
OIDC-only SSO is a dealbreakerConsider alternatives or Stitchflow: native only supports OIDC

The bottom line

Airbyte's Enterprise requirement for SCIM means most data teams face custom pricing to automate user provisioning—a significant jump from their $10/month Cloud plan. For teams that need SCIM without the Enterprise tier complexity, Stitchflow delivers managed automation at predictable flat pricing.

Make Airbyte workflows AI-native

Airbyte gates SCIM behind Enterprise or Cloud Team/Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.

No Enterprise or Cloud Team/Enterprise upgrade required
Less than a week, start to finish (~2 hours of your time)
We maintain the integration layer underneath
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Enterprise

Prerequisites

SSO must be configured first

Key limitations

  • Enterprise plan required
  • SSO via OIDC (not SAML)
  • Self-hosted SSO was roadmap item

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Airbyte → Provisioning

Required credentials

Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).

Configuration steps

Set Provisioning Mode = Automatic, configure SCIM connection.

Provisioning trigger

Entra provisions based on user/group assignments to the enterprise app.

Sync behavior

Entra provisioning runs on a scheduled cycle (typically every 40 minutes).

SSO via OpenID Connect (OIDC). Configure as Enterprise Application in Azure Portal. Requires Company Identifier from Airbyte. Admin consent may be required. Can't claim domain if already used by another org.

Airbyte gates SCIM behind Enterprise or Cloud Team/Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Unlock SCIM for
Airbyte

Airbyte gates SCIM behind Enterprise or Cloud Team/Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.

See how it works
Admin Console
Directory
Applications
Airbyte logo
Airbyte
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

8x8 logo

8x8

SCIM Tax

UCaaS / Business Communications

SCIM StatusIncluded
Manual Cost$11,754/yr

8x8 supports SCIM 2.0 for automated user provisioning, but only on their quote-based X Series plans (previously $24-44/user/month range before they moved to custom pricing). While SCIM can create, update, and deactivate users, it has critical gaps that create ongoing manual overhead: license assignment must be done manually after every user is provisioned, users can't be deleted (only deactivated), and provisioned users don't automatically appear in the Company Directory. For IT teams managing a unified communications platform that typically covers all employees, these limitations defeat much of SCIM's purpose. You're still manually touching every user account to assign licenses and ensure directory visibility. The lack of user deletion support also creates compliance headaches when employees leave - accounts accumulate as "deactivated" rather than being properly removed.

View full guide
Absorb LMS logo

Absorb LMS

SCIM Tax

Learning Management System (LMS)

SCIM StatusIncluded
Manual Cost$11,754/yr

Absorb LMS supports native SCIM provisioning, but only on Enterprise plans with SSO as a required paid add-on. Even with SCIM enabled, the implementation has critical limitations: SAML provisioning only creates accounts on first login and never updates existing users, and full user provisioning requires the specific "Absorb 5 - New Learner Experience" version. For organizations managing compliance training across hundreds or thousands of learners, these gaps create ongoing manual work. The SSO-as-add-on model means you're paying extra fees on top of already custom Enterprise pricing ($6-12/user/month base, but varies significantly). For learning management systems handling external partners, contractors, and employees across different access levels, the inability to update existing user attributes through SAML provisioning forces IT teams into manual account management—exactly what automated provisioning should eliminate.

View full guide
Airbase logo

Airbase

SCIM Tax

Spend Management / Corporate Cards

SCIM StatusIncluded
Manual Cost$11,754/yr

Airbase supports SCIM provisioning, but only on Enterprise plans starting around $8,500/year. While SCIM works with all major identity providers (Okta, Entra ID, Google Workspace), the Enterprise requirement creates a significant barrier for smaller finance teams who need automated provisioning for spend management but can't justify enterprise-level spend management software costs. This creates a particular challenge in finance applications where rapid provisioning and deprovisioning is critical for corporate card access and financial controls. Manual user management means delayed access for new employees needing corporate cards, and more critically, potential security gaps when departing employees retain access to spend management systems. For finance teams handling sensitive financial data and corporate spending, these delays and oversights create both operational friction and compliance risks.

View full guide