Summary and recommendation
OpenText ArcSight supports native SCIM user provisioning through its ESM platform, but only on Enterprise plans that cost approximately $600K+ annually for 10K EPS. While SCIM provisioned users appear in dedicated groups within ArcSight, the astronomical licensing costs put automated provisioning out of reach for most organizations. Additionally, major identity providers like Okta and Microsoft Entra lack pre-built ArcSight integrations in their galleries, requiring custom SCIM API development work.
This creates a significant operational gap for security teams managing ArcSight deployments. Manual user provisioning in a SIEM platform creates serious security risks - delayed access for security analysts during incidents, orphaned accounts when staff leave, and compliance violations when audit logs show manual account management. For a platform handling your organization's most sensitive security data, manual provisioning is simply inadequate.
The strategic alternative
OpenText ArcSight gates SCIM behind Enterprise. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across the rest of your stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ❌ | SSO only |
| Microsoft Entra ID | ✓ | ❌ | SSO only |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages OpenText ArcSight accounts manually. Here's what that costs:
The OpenText ArcSight pricing problem
OpenText ArcSight gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Pro | Custom | ||
| Business | Custom | ||
| Enterprise | $600K+ (10K EPS) |
Plan Structure
| Plan | Price | SCIM |
|---|---|---|
| Pro | Custom | ❌ |
| Business | Custom | ❌ |
| Enterprise | $600K+ (10K EPS) | ✓ |
Note: ArcSight pricing is entirely custom and based on EPS capacity. The $600K figure represents typical Enterprise deployments handling 10,000 events per second.
What this means in practice
ArcSight's pricing model creates several challenges:
For context, organizations typically need Enterprise-level EPS capacity (and pricing) to justify SCIM automation, making this a $500K+ annual decision rather than a user provisioning choice.
Additional constraints
Summary of challenges
- OpenText ArcSight supports SCIM but only at Enterprise tier (Custom (approx $600K+ for 10K EPS))
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
OpenText ArcSight doesn't sell SCIM à la carte. It's bundled with their Enterprise Security Management platform:
The catch? You're looking at approximately $600K+ annually for a 10,000 EPS (Events Per Second) deployment. This is enterprise security infrastructure pricing, not identity management pricing.
The complexity extends beyond cost—ArcSight deployments typically require dedicated security engineering resources and lengthy implementation cycles, making it overkill for straightforward user provisioning needs.
Stitchflow Insight
If you need comprehensive SIEM capabilities anyway, the native SCIM may justify itself. But if you just want automated user provisioning for ArcSight access, you're paying enterprise security platform costs for basic identity functionality. We estimate ~85% of ArcSight's feature set is irrelevant for teams that only need SCIM provisioning.
What IT admins are saying
Community sentiment on OpenText ArcSight's SCIM implementation is mixed, with concerns about cost and complexity dominating the conversation. Common complaints:
- Enterprise-only SCIM access with custom pricing starting around $600K+ for 10K EPS
- Complete absence from major IdP catalogs (Okta OIN, Entra Gallery) requiring manual integration
- Complex deployment and ongoing management overhead
- Lack of pre-built connectors forcing custom development work
ArcSight is notoriously expensive and complex to deploy. The licensing costs alone can be prohibitive for many organizations.
We looked at ArcSight but the pricing was just astronomical. For what we'd pay for ArcSight, we could probably buy three other SIEM solutions.
The recurring theme
ArcSight's SCIM capabilities come with enterprise-grade pricing and complexity, making basic identity automation an expensive proposition that requires significant technical investment.
The decision
| Your Situation | Recommendation |
|---|---|
| Need SCIM but can't justify $600K+ Enterprise pricing | Use Stitchflow: start with a free gap diagnostic, then build the workflow across every app without asking your team to own the plumbing. |
| On lower ArcSight tiers without SCIM | Use Stitchflow: avoid the massive Enterprise upgrade |
| Already on Enterprise with native SCIM | Use native SCIM: you're paying premium prices for it |
| Large security team with complex ArcSight deployment | Evaluate Enterprise: SCIM comes with the territory |
| Small security footprint, infrequent user changes | Manual may work short-term: but watch for security gaps |
The bottom line
OpenText ArcSight gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the OpenText ArcSight workflow gap
OpenText ArcSight gates SCIM behind Enterprise, but the bigger issue is the workflow around it. Stitchflow builds and maintains the offboarding, access review, or license workflow underneath.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
None
Key limitations
- Native SCIM API available in ArcSight ESM for user provisioning
- SCIM provisioned users appear in SCIM Provisioned Users Group
- Very expensive - often cited as super expensive by users
- Now owned by OpenText (acquired from Micro Focus)
- Complex deployment and management
- No pre-built IdP integrations in major catalogs
Documentation not available.
Close the workflow gap in
OpenText ArcSight
OpenText ArcSight gates SCIM behind Enterprise plan. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across your stack.
Start with the free gap diagnostic
