Summary and recommendation
Basecamp offers automated user provisioning only through Okta's connector, which uses a proprietary API rather than the standard SCIM 2.0 protocol. This integration is available with Basecamp's Business plan ($299/month flat rate for unlimited users), but creates significant limitations for IT teams: you're locked into Okta as your identity provider, with no native SCIM support for Entra ID, Google Workspace, or other platforms. While Basecamp does support SAML SSO across multiple IdPs, SSO alone only handles authentication—users must still be manually created and managed in Basecamp.
This creates a problematic gap for organizations using non-Okta identity providers or those requiring standardized SCIM implementations. IT teams end up managing Basecamp users manually or through custom scripts, increasing operational overhead and compliance risk. The lack of true SCIM 2.0 support means you can't leverage your existing provisioning workflows or easily switch identity providers without losing automation capabilities.
The strategic alternative
Basecamp gates SCIM behind Business. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across the rest of your stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Business |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ❌ | SSO only |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Basecamp accounts manually. Here's what that costs:
The Basecamp pricing problem
Basecamp gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Starter | $15/user/month | ||
| Business | $299/month flat (unlimited users) |
Pricing and provisioning options
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Starter | $15/user/month | ||
| Business | $299/month flat (unlimited users) |
What this means in practice
For organizations using other identity providers: If you're standardized on Entra ID, Google Workspace, or OneLogin, you're locked out of automated provisioning entirely. Manual user management becomes the only option, regardless of organization size.
For Okta users: While provisioning is technically possible, you're dependent on Basecamp's proprietary API implementation through Okta's connector. This creates a single point of failure - if the connector breaks or Basecamp changes their API, provisioning stops working until both vendors coordinate a fix.
Flat pricing creates hidden complexity: The $299/month unlimited user model seems straightforward, but without proper provisioning automation, IT teams often end up paying for inactive users who were never properly deprovisioned when they left projects or the organization.
Additional constraints
Summary of challenges
- Basecamp supports SCIM but only at Business tier (custom pricing)
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Basecamp actually offers for identity
Basecamp doesn't offer native SCIM. Instead, provisioning depends on third-party connectors that only work with specific identity providers:
Okta Connector (Business plan required)
For all other identity providers (Entra ID, Google Workspace, OneLogin)
The fundamental problem: Basecamp's Business plan ($299/month flat rate) includes unlimited users but forces you into either Okta vendor lock-in for automation or manual user management for everything else. There's no SCIM 2.0 standard implementation that works universally across identity providers.
This creates an architectural mismatch—you get flat-rate pricing that should eliminate per-user overhead, but without proper provisioning automation, IT teams still spend time manually managing user lifecycles, especially during project transitions and employee departures.
What IT admins are saying
Community sentiment on Basecamp's provisioning reveals frustration with limited automation options:
- Okta-only provisioning - Automated user management only works through Okta's proprietary connector, leaving Azure AD and Google Workspace admins with manual processes
- No native SCIM support - Unlike modern SaaS apps, Basecamp doesn't offer standard SCIM 2.0 endpoints that work with any identity provider
- Documentation gaps - IT teams struggle to find clear guidance on provisioning options beyond Okta
- Project access complexity - Managing user access across multiple Basecamp projects requires manual coordination
Limited IdP options documented
Check Basecamp docs for other IdP support
The recurring theme
Basecamp's provisioning automation is essentially an Okta exclusive feature. Organizations using Azure AD, Google Workspace, or other identity providers must handle user lifecycle management manually, creating ongoing administrative overhead despite Basecamp's flat-rate pricing model making user additions cost-neutral.
The decision
| Your Situation | Recommendation |
|---|---|
| Using Okta with Business plan | Use Okta's native connector: you have full provisioning automation |
| Using Entra ID, Google Workspace, or OneLogin | Use Stitchflow: no native provisioning options available |
| Small teams (<10 users) with manual tolerance | Manual may work: but monitor deprovisioning gaps |
| Growing teams or compliance requirements | Use Stitchflow: avoid vendor lock-in and get audit trails |
| Evaluating Basecamp vs competitors | Consider alternatives: Asana and Monday.com offer standard SCIM |
The bottom line
Basecamp gates SCIM behind Business. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the Basecamp workflow gap
Basecamp gates SCIM behind Business, but the bigger issue is the workflow around it. Stitchflow builds and maintains the offboarding, access review, or license workflow underneath.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Business
Prerequisites
SSO must be configured first
Key limitations
- No native SCIM - provisioning via Okta connector only
- Uses proprietary API via Okta/OneLogin connectors, not SCIM 2.0
- Check Basecamp docs for other IdP support
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
Docs
Business required for SCIM
Basecamp gates SCIM behind Business. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the workflow gap in
Basecamp
Basecamp gates SCIM behind Business plan. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across your stack.
Start with the free gap diagnostic
