Summary and recommendation
Argo CD, the popular open-source GitOps continuous delivery tool, does not support SCIM provisioning at all. As an open-source project, Argo CD relies on SSO via the bundled Dex identity provider (supporting SAML, OIDC, and LDAP) for authentication, but user access management happens through manual ConfigMap edits. Platform teams must maintain RBAC policies in the argocd-rbac-cm ConfigMap, mapping IdP groups to Argo CD roles, while group information only refreshes at authentication time—not when group membership changes in your identity provider.
This creates significant operational overhead for platform teams managing Kubernetes deployments. When developers join or leave teams, or when project access needs change, administrators must manually update ConfigMaps and restart Argo CD components to reflect new permissions. For organizations with frequent team changes or complex namespace-based access patterns, this manual process becomes a bottleneck that contradicts the automation principles GitOps is meant to deliver. Even Akuity's enterprise managed service doesn't add SCIM support—it only provides hosting and support for the same underlying architecture.
The strategic alternative
Stitchflow provides managed provisioning automation for Argo CD, handling the ConfigMap updates and group synchronization automatically as your team structure changes. Works with any Argo CD deployment and any identity provider. Flat pricing under $5K/year, regardless of team size.
Quick SCIM facts
| SCIM available? | No |
| SCIM tier required | N/A |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0, OIDC, LDAP (via Dex) |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | Via third-party | ❌ | No SCIM. Supports OIDC SSO direct integration (without Dex) or SAML via Dex. Configure via argocd-cm ConfigMap. RBAC managed via argocd-rbac-cm ConfigMap with group mappings. |
| Microsoft Entra ID | Via third-party | ❌ | No SCIM. Supports native OIDC SSO with Entra ID (recommended) or SAML via Dex. Workload Identity Federation supported for AKS clusters. RBAC via ConfigMaps with Entra group IDs. |
| Google Workspace | Via third-party | ❌ | No native support |
| OneLogin | Via third-party | ❌ | No native support |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Argo CD accounts manually. Here's what that costs:
The Argo CD pricing problem
Argo CD gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Open Source | Free | ||
| Akuity Platform | $99/month per 10 apps | ||
| Akuity Enterprise | Custom pricing |
Pricing structure
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Open Source | Free | ||
| Akuity Platform | $99/month per 10 apps | ||
| Akuity Enterprise | Custom pricing |
What this means in practice
Without SCIM, Argo CD user provisioning requires a hybrid approach:
Initial setup burden
Ongoing management friction
Example RBAC ConfigMap complexity
``yaml policy.csv: | p, role:admin, applications, , /, allow p, role:dev-team, applications, get, dev/, allow g, your-idp-group-id, role:dev-team ``
Additional constraints
Summary of challenges
- Argo CD does not provide native SCIM at any price tier
- Organizations must rely on third-party tools or manual provisioning
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Argo CD actually offers for identity
SSO via Dex (Open Source)
Argo CD bundles the Dex identity proxy to handle authentication with third-party identity providers:
| Setting | Details |
|---|---|
| Protocol | SAML 2.0, OIDC, LDAP |
| Supported IdPs | Okta, Entra ID, Google Workspace, GitHub, GitLab, generic SAML/OIDC |
| Configuration | Edit argocd-cm ConfigMap with Dex connector settings |
| User provisioning | Just-in-time (JIT) only - no account pre-creation required |
How RBAC works: User permissions are managed through the argocd-rbac-cm ConfigMap, where you map IdP groups to Argo CD roles (readonly, admin, or custom policies).
Native OIDC Support (Alternative)
Argo CD also supports direct OIDC integration without Dex:
This bypasses Dex but still requires manual ConfigMap management for RBAC policies.
Core Limitation: No User Provisioning
Both approaches provide SSO authentication but zero provisioning capabilities:
For platform teams managing hundreds of developers across multiple Kubernetes namespaces and applications, this creates significant operational overhead and security gaps.
What IT admins are saying
Argo CD's lack of native SCIM creates ongoing operational overhead for platform teams managing GitOps at scale:
- RBAC policies must be manually maintained via ConfigMaps whenever team structures change
- Group membership updates only sync when users authenticate, not in real-time
- Complex SSO setup through Dex adds another configuration layer to maintain
- No automated user lifecycle management means manual cleanup when employees leave
Group info only refreshed at authentication time
No SCIM means RBAC managed via ConfigMaps
Manual ConfigMap edits for RBAC changes
The recurring theme
Even with SSO working, platform teams spend significant time manually syncing identity provider changes to RBAC ConfigMaps, and stale group memberships persist until users next authenticate.
The decision
| Your Situation | Recommendation |
|---|---|
| Small DevOps team (<10 engineers) | Manual RBAC ConfigMap management is workable |
| Single Kubernetes cluster with stable team | SSO + manual group mappings acceptable |
| Platform team managing 20+ apps/namespaces | Use Stitchflow: RBAC complexity demands automation |
| Multi-cluster enterprise with compliance needs | Use Stitchflow: audit trails and consistent access essential |
| Frequent developer onboarding/offboarding | Use Stitchflow: manual ConfigMap updates don't scale |
The bottom line
Argo CD is an excellent GitOps tool, but it lacks SCIM entirely—forcing you to manage access through IdP groups and manual RBAC ConfigMaps. For platform teams managing complex Kubernetes environments where access changes frequently, Stitchflow eliminates the operational overhead of ConfigMap management while maintaining the security controls you need.
Automate Argo CD without third-party complexity
Stitchflow delivers SCIM-level provisioning through resilient browser automation, backed by 24/7 human in the loop for Argo CD at <$5K/year, flat, regardless of team size.
Technical specifications
SCIM Version
Not specifiedSupported Operations
Not specifiedSupported Attributes
Plan requirement
Not specifiedPrerequisites
Not specifiedKey limitations
- No native SCIM provisioning
- User/group management via IdP and RBAC ConfigMaps
- Group info only refreshed at authentication time
- Manual ConfigMap edits for RBAC changes
Documentation not available.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app
Where to enable
No SCIM. Supports native OIDC SSO with Entra ID (recommended) or SAML via Dex. Workload Identity Federation supported for AKS clusters. RBAC via ConfigMaps with Entra group IDs.
Use Stitchflow for automated provisioning.
Unlock SCIM for
Argo CD
Argo CD doesn't offer SCIM. Get an enterprise-grade SCIM endpoint in your IdP, even without native support.
See how it works