Atlassian Jira Service Management SCIM guide

15Five includes SCIM provisioning on all plans starting at $4/user/month, with full support for creating, updating, and deactivating users across Okta, Entra ID, Google Workspace, and OneLogin. However, 15Five's SCIM implementation has a critical prerequisite: SSO must be configured first, and their documentation explicitly warns against using JIT provisioning alongside SCIM due to duplicate user creation risks. This creates operational friction for IT teams managing performance management rollouts. The SSO-first requirement means you can't test SCIM provisioning in isolation, and the JIT conflict forces you to choose between automated onboarding convenience and reliable user lifecycle management. For HR-driven tools like 15Five that need to maintain accurate manager hierarchies and team structures, these provisioning gaps can disrupt performance review cycles and employee engagement tracking.

Dropbox Business supports SCIM 2.0 provisioning on Standard plans and above ($15/user/month), with solid integration across major identity providers including Okta, Azure AD, and Google Workspace. However, there's a critical architectural limitation: Dropbox Sign (formerly HelloSign) operates as a separate product that doesn't support SCIM at all, despite being a core part of many organizations' document workflows. This creates a significant provisioning gap for IT teams. While your main Dropbox storage accounts can be automatically managed, any users who need access to Dropbox Sign must be manually provisioned and deprovisioned. For organizations relying on both products, this means maintaining hybrid workflows where some users are automated and others require manual intervention—exactly the kind of inconsistency that leads to compliance issues and security gaps during employee transitions.

AWS IAM Identity Center supports SCIM 2.0 provisioning and is completely free—no additional licensing costs beyond your AWS account. However, the implementation has significant operational limitations that create ongoing management overhead for IT teams. The core issues: SCIM sync runs every 20-40 minutes (not real-time), multivalue attributes aren't supported, and once SCIM is enabled, you lose the ability to manually manage users through the AWS console. More problematic, Azure AD users face nested group limitations and attribute removal sync issues, while all IdPs must work around the requirement for specific mandatory fields (First name, Last name, Username, Display name). For organizations managing complex AWS multi-account environments with varying permission sets, these constraints force manual workarounds that undermine automation benefits. While IAM Identity Center's free pricing is attractive, the operational friction from sync delays, attribute limitations, and console lockout creates hidden administrative costs—especially when managing hundreds of users across multiple AWS accounts with different access requirements.