Summary and recommendation
Ashby supports SCIM 2.0 for automated user provisioning, but only on its Growth and Enterprise tiers. While Ashby's newer pricing structure starts at $400/month for Foundations (up to 100 employees), SCIM requires upgrading to Growth or Enterprise with custom pricing. For most organizations, this means annual contracts starting around $6K-$15K, plus additional costs for elevated seats ($800/year each) and dedicated recruiter licenses ($350-750/month).
This creates a significant access control gap for recruiting teams. Without automated provisioning, IT admins must manually manage access to sensitive candidate data and personally identifiable information (PII). Hiring managers who need temporary access to specific job openings often get over-provisioned permissions, while departing employees may retain access to confidential recruiting data longer than necessary.
The strategic alternative
Stitchflow provides managed SCIM automation for Ashby without requiring tier upgrades. Works with any Ashby plan and any identity provider. Flat pricing under $5K/year with SOC 2 Type II certification and 24/7 human-in-the-loop support.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0, OIDC |
| Documentation | Official docs |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ✓ | Gallery app with SCIM |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Ashby accounts manually. Here's what that costs:
The Ashby pricing problem
Ashby gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Plan Structure
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Foundations | $400/mo (up to 100 employees) | ||
| Plus | Custom pricing | ||
| Enterprise | Custom pricing |
Note: Ashby requires contact with sales for Plus and Enterprise pricing. SCIM is bundled with SSO - no password authentication is supported once SSO is enabled.
What this means in practice
Based on Ashby's pricing patterns ($5-8/employee/month scaling with typical annual contracts of $6K-$15K):
| Team Size | Foundations Cost | Estimated Plus/Enterprise | Annual Increase |
|---|---|---|---|
| 25 recruiting users | $4,800/year | $6,000-12,000/year | +$1,200-7,200/year |
| 50 recruiting users | Must upgrade* | $8,000-15,000/year | Forced upgrade |
| 100+ recruiting users | Must upgrade* | $12,000-20,000+/year | Forced upgrade |
*Foundations caps at 100 employees company-wide, not just recruiting users
Additional constraints
Summary of challenges
- Ashby supports SCIM but only at Enterprise tier (custom pricing)
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Ashby doesn't sell SCIM separately. It's bundled with Growth/Enterprise features that most recruiting teams won't fully utilize:
The Growth tier starts around $6K-15K annually for most teams, while Enterprise pricing requires sales contact. If you're upgrading solely for user provisioning, you're paying for recruitment analytics, custom integrations, and premium support that many ATS admins never use.
Stitchflow Insight
We estimate ~60% of Growth/Enterprise features are irrelevant for IT teams that just need automated user lifecycle management for their recruiting platform. You're essentially paying enterprise ATS prices to solve an identity management problem.
What IT admins are saying
Community sentiment on Ashby's SCIM requirements centers around tier restrictions and pricing transparency issues. Common complaints:
- SSO and SCIM locked behind higher-priced Growth/Enterprise tiers
- Enterprise pricing requires contacting sales with no public rates
- No password authentication fallback creates vendor lock-in concerns
- Pricing structure feels opaque compared to transparent competitors
"Enterprise features require higher tiers" and "Pricing not fully transparent" are consistent themes in admin feedback about Ashby's approach to identity management.
The recurring theme
Ashby gates essential security features behind enterprise sales processes, making it difficult for IT teams to budget and plan for proper user provisioning without lengthy sales cycles.
The decision
| Your Situation | Recommendation |
|---|---|
| On Foundations, need SCIM | Use Stitchflow: avoid the custom pricing tier jump to Growth/Enterprise |
| Already on Growth/Enterprise with SCIM | Use native SCIM: you're paying for it |
| Need Enterprise features beyond SCIM | Evaluate Growth/Enterprise: SCIM comes bundled |
| Recruiting team with sensitive candidate data | Use Stitchflow: SOC 2 compliance without tier upgrade costs |
| Small recruiting footprint, low hiring manager churn | Manual may work: but monitor for candidate data access gaps |
The bottom line
Ashby's SCIM requires moving from the transparent $400/month Foundations plan to custom-priced Growth or Enterprise tiers. For recruiting teams that need automated provisioning without the pricing uncertainty, Stitchflow delivers SOC 2-compliant automation at predictable flat-rate pricing.
Automate Ashby without the tier upgrade
Stitchflow delivers SCIM-level provisioning through resilient browser automation, backed by 24/7 human in the loop for Ashby at <$5K/year, flat, regardless of team size.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
SSO must be configured first
Key limitations
- SSO/SCIM on higher tiers only
- No password authentication supported
- Contact sales for enterprise pricing
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
OIN partner-built integration. Supports SSO, SCIM, entitlements, universal logout, workflows. OIDC connection available.
Native SCIM is available on Enterprise. Use Stitchflow if you need provisioning without the tier upgrade.
Unlock SCIM for
Ashby
Ashby gates automation behind Growth/Enterprise plan. Stitchflow delivers the same SCIM outcomes for a flat fee.
See how it works