Asana SCIM guide

ChatGPT Enterprise supports native SCIM 2.0 for automated user provisioning, but OpenAI restricts this capability to their highest-tier Enterprise plan with custom pricing (estimated ~$60/seat for 70+ users). The Business plan includes SSO but deliberately excludes SCIM, forcing IT teams into manual user management despite paying $25-30/user/month. This creates a significant pricing cliff: teams must jump from Business to Enterprise—often doubling their spend—just to automate basic user lifecycle operations. This gap between SSO and SCIM creates operational friction for IT teams managing AI tool adoption. While employees can authenticate through your identity provider on the Business plan, you still need to manually provision accounts, manage group memberships, and handle offboarding. For organizations rapidly scaling ChatGPT usage across departments, this manual overhead becomes a bottleneck. The 40-minute sync delay on Azure Entra ID compounds these challenges, making real-time access management impossible even on Enterprise.

LastPass supports SCIM provisioning starting at the Business tier ($7/user/month), with integration support for all major identity providers including Okta, Entra ID, Google Workspace, and OneLogin. However, LastPass SCIM has critical limitations around deprovisioning: when users are removed, their vault access isn't immediately revoked, and shared folder permissions become complex to manage at scale. This creates a significant security gap for IT teams. Password vaults contain the most sensitive credentials in your organization—API keys, service accounts, privileged access passwords. When employees leave or change roles, their access to these credentials must be revoked immediately, not left accessible while IT manually cleans up vault permissions. SSO alone doesn't solve this because it only controls login authentication, not ongoing vault access or shared resource permissions.

1Password supports SCIM provisioning on its Business plan ($7.99/user/month), but requires deploying and managing the 1Password SCIM Bridge on your own infrastructure. This self-hosted approach means you're responsible for maintaining servers, handling updates, and troubleshooting connectivity issues between your identity provider and 1Password's systems. The SCIM Bridge also operates separately from SSO (which uses OIDC only), requiring you to configure and maintain two distinct integrations. This architecture creates operational overhead that many IT teams don't want to manage. Unlike cloud-native SCIM implementations, you're essentially running 1Password's provisioning infrastructure for them. When the SCIM Bridge goes down, provisioning stops working. When 1Password updates their API, you need to update your Bridge deployment. For teams that just want automated user lifecycle management, this becomes an ongoing maintenance burden.