Bill.com SCIM guide

Amplitude supports SCIM provisioning, but only on Growth plans (starting around $36K/year) or Enterprise plans with custom pricing. While Amplitude's SCIM implementation covers the core functionality—creating, updating, and deactivating users—it requires SCIM to be specifically enabled for your organization, and regenerating the SCIM key immediately invalidates existing integrations without warning. For product teams on Plus plans ($49/month), upgrading to Growth just to unlock SCIM means jumping from under $600/year to $36,000+/year—a 60x increase. That's often more than the entire analytics budget for smaller product teams. The gap becomes particularly problematic for cross-functional product teams where analysts, PMs, and engineers need varying levels of access to user behavior data, but manual provisioning creates security risks around sensitive analytics permissions.

Bitwarden supports SCIM 2.0 provisioning, but only on Teams ($4/user/month) and Enterprise ($6/user/month) plans. While this pricing is reasonable compared to other password managers, the real challenge lies in Bitwarden's zero-knowledge architecture: SCIM can provision user accounts, but users still need to manually accept vault invitations and set up their encryption keys before gaining access to shared passwords. This creates a critical security gap. Your identity provider shows users as "provisioned," but they can't actually access company passwords until they complete manual setup steps. When employees leave, SCIM deprovisioning removes their account, but any locally cached vault data remains accessible until they next sync. For security teams managing hundreds of shared credentials, this manual friction undermines the entire purpose of automated provisioning.

Braintree supports native SCIM 2.0 provisioning, but only for Enterprise merchants who complete a complex multi-step onboarding process. You must first configure SSO, onboard through their sandbox environment, convert all existing non-SSO users, and then request SCIM enablement. Once enabled, you lose the ability to manage SSO users through Braintree's UI entirely—everything must go through your IdP. The rigid prerequisites create significant friction for payment teams. The sandbox requirement alone adds weeks to deployment timelines, and the all-or-nothing approach to user management means you can't gradually roll out automated provisioning. For organizations processing payments across multiple merchant accounts with complex role hierarchies, this inflexibility becomes a major operational constraint.