Summary and recommendation
OpenText ArcSight supports native SCIM user provisioning through its ESM platform, but only on Enterprise plans that cost approximately $600K+ annually for 10K EPS. While SCIM provisioned users appear in dedicated groups within ArcSight, the astronomical licensing costs put automated provisioning out of reach for most organizations. Additionally, major identity providers like Okta and Microsoft Entra lack pre-built ArcSight integrations in their galleries, requiring custom SCIM API development work.
This creates a significant operational gap for security teams managing ArcSight deployments. Manual user provisioning in a SIEM platform creates serious security risks - delayed access for security analysts during incidents, orphaned accounts when staff leave, and compliance violations when audit logs show manual account management. For a platform handling your organization's most sensitive security data, manual provisioning is simply inadequate.
The strategic alternative
OpenText ArcSight gates SCIM behind Enterprise. Skip the Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ❌ | SSO only |
| Microsoft Entra ID | ✓ | ❌ | SSO only |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages OpenText ArcSight accounts manually. Here's what that costs:
The OpenText ArcSight pricing problem
OpenText ArcSight gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Pro | Custom | ||
| Business | Custom | ||
| Enterprise | $600K+ (10K EPS) |
Plan Structure
| Plan | Price | SCIM |
|---|---|---|
| Pro | Custom | ❌ |
| Business | Custom | ❌ |
| Enterprise | $600K+ (10K EPS) | ✓ |
Note: ArcSight pricing is entirely custom and based on EPS capacity. The $600K figure represents typical Enterprise deployments handling 10,000 events per second.
What this means in practice
ArcSight's pricing model creates several challenges:
For context, organizations typically need Enterprise-level EPS capacity (and pricing) to justify SCIM automation, making this a $500K+ annual decision rather than a user provisioning choice.
Additional constraints
Summary of challenges
- OpenText ArcSight supports SCIM but only at Enterprise tier (Custom (approx $600K+ for 10K EPS))
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
OpenText ArcSight doesn't sell SCIM à la carte. It's bundled with their Enterprise Security Management platform:
The catch? You're looking at approximately $600K+ annually for a 10,000 EPS (Events Per Second) deployment. This is enterprise security infrastructure pricing, not identity management pricing.
The complexity extends beyond cost—ArcSight deployments typically require dedicated security engineering resources and lengthy implementation cycles, making it overkill for straightforward user provisioning needs.
Stitchflow Insight
If you need comprehensive SIEM capabilities anyway, the native SCIM may justify itself. But if you just want automated user provisioning for ArcSight access, you're paying enterprise security platform costs for basic identity functionality. We estimate ~85% of ArcSight's feature set is irrelevant for teams that only need SCIM provisioning.
What IT admins are saying
Community sentiment on OpenText ArcSight's SCIM implementation is mixed, with concerns about cost and complexity dominating the conversation. Common complaints:
- Enterprise-only SCIM access with custom pricing starting around $600K+ for 10K EPS
- Complete absence from major IdP catalogs (Okta OIN, Entra Gallery) requiring manual integration
- Complex deployment and ongoing management overhead
- Lack of pre-built connectors forcing custom development work
ArcSight is notoriously expensive and complex to deploy. The licensing costs alone can be prohibitive for many organizations.
We looked at ArcSight but the pricing was just astronomical. For what we'd pay for ArcSight, we could probably buy three other SIEM solutions.
The recurring theme
ArcSight's SCIM capabilities come with enterprise-grade pricing and complexity, making basic identity automation an expensive proposition that requires significant technical investment.
The decision
| Your Situation | Recommendation |
|---|---|
| Need SCIM but can't justify $600K+ Enterprise pricing | Use Stitchflow: build complete workflows across every app in less than a week (~2 hours of your time). |
| On lower ArcSight tiers without SCIM | Use Stitchflow: avoid the massive Enterprise upgrade |
| Already on Enterprise with native SCIM | Use native SCIM: you're paying premium prices for it |
| Large security team with complex ArcSight deployment | Evaluate Enterprise: SCIM comes with the territory |
| Small security footprint, infrequent user changes | Manual may work short-term: but watch for security gaps |
The bottom line
ArcSight's Enterprise-only SCIM requirement creates a massive pricing barrier—often $600K+ annually just to enable user provisioning. For organizations that need automated provisioning without the enterprise price tag, Stitchflow delivers the same functionality at a fraction of the cost.
Make OpenText ArcSight workflows AI-native
OpenText ArcSight gates SCIM behind Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
None
Key limitations
- Native SCIM API available in ArcSight ESM for user provisioning
- SCIM provisioned users appear in SCIM Provisioned Users Group
- Very expensive - often cited as super expensive by users
- Now owned by OpenText (acquired from Micro Focus)
- Complex deployment and management
- No pre-built IdP integrations in major catalogs
Documentation not available.
Unlock SCIM for
OpenText ArcSight
OpenText ArcSight gates SCIM behind Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.
See how it works
