Summary and recommendation
Chargebee, the subscription billing platform, does not offer native SCIM provisioning on any plan. While Chargebee supports SAML 2.0 SSO (Enterprise plan required), user provisioning must be handled manually or through Okta's custom connector that provides limited SCIM 2.0 functionality. This creates a significant gap for IT teams managing finance and billing operations teams, where access to sensitive billing data requires precise role-based provisioning. The situation is further complicated by Chargebee's limitation of only supporting one IdP per site and their requirement to disable native 2FA when SSO is enabled.
The lack of comprehensive SCIM support means IT admins must manually create, update, and deactivate user accounts in Chargebee—a risky proposition when dealing with access to revenue data, customer billing information, and subscription management tools. For organizations using identity providers other than Okta, there's no automated provisioning option at all. This manual overhead becomes particularly problematic as finance teams scale and require rapid onboarding/offboarding while maintaining strict access controls around billing operations.
The strategic alternative
Chargebee has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.
Quick SCIM facts
| SCIM available? | No |
| SCIM tier required | N/A |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ❌ | No SCIM available |
| Microsoft Entra ID | ✓ | ❌ | No SCIM available |
| Google Workspace | Via third-party | ❌ | No native support |
| OneLogin | Via third-party | ❌ | No native support |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Chargebee accounts manually. Here's what that costs:
The Chargebee pricing problem
Chargebee gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Starter | $0 (0.75% overage above $250K) | ||
| Performance | $599/month | ||
| Enterprise | Custom pricing |
Pricing structure
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Starter | $0 (0.75% overage above $250K) | ||
| Performance | $599/month | ||
| Enterprise | Custom pricing |
*SCIM available only through Okta's third-party connector
What this means in practice
For growing companies: You'll hit the Enterprise pricing wall twice - first when you need SSO (which disables Chargebee's native 2FA), and again when you want automated provisioning beyond manual user creation.
For multi-IdP environments: The Okta SCIM connector locks you into a single IdP choice. If you use Entra ID, Google Workspace, or OneLogin, you're back to manual provisioning even at the Enterprise tier.
Additional constraints
Summary of challenges
- Chargebee does not provide native SCIM at any price tier
- Organizations must rely on third-party tools or manual provisioning
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Enterprise Plan Identity Features
Chargebee's Enterprise plan includes SAML SSO and enhanced security features:
| Feature | Details |
|---|---|
| SAML SSO | SAML 2.0 with major IdPs (Okta, Entra, OneLogin) |
| Multi-entity support | Manage multiple business entities in one account |
| Advanced analytics | Revenue recognition and cohort analysis |
| Custom branding | White-label customer portals |
| API rate limits | Higher limits for enterprise integrations |
Critical SSO limitation: Enabling SAML SSO automatically disables Chargebee's native two-factor authentication. Your IdP must handle MFA requirements.
SCIM Provisioning (Okta Only)
Chargebee doesn't provide native SCIM APIs. Instead, provisioning works exclusively through Okta's pre-built connector:
Why this matters for billing teams: Access to subscription and revenue data is highly sensitive. The Okta-only provisioning means teams using Entra, Google Workspace, or OneLogin have no automated user lifecycle management options.
The Enterprise pricing reality
Most teams upgrading to Enterprise for SCIM provisioning will pay for features they'll never use:
Bottom line: You're paying Enterprise pricing to get basic identity management that should be standard in any SaaS billing platform.
What IT admins are saying
Community sentiment on Chargebee's provisioning highlights the disconnect between their billing sophistication and identity management capabilities:
- Enterprise plan required for SSO - no SCIM at any tier
- Single IdP limitation per Chargebee site restricts multi-tenant organizations
- Enabling SAML disables Chargebee's native 2FA, forcing MFA reliance on IdP
- Manual user provisioning creates ongoing administrative overhead
Only one IdP can be configured per Chargebee site
Enabling SAML disables 2FA in Chargebee
The recurring theme
Finance teams get a powerful billing platform, but IT teams inherit manual user lifecycle management. For a company handling sensitive billing data, the lack of automated provisioning and the 2FA trade-off when enabling SSO creates security and operational friction.
The decision
| Your Situation | Recommendation |
|---|---|
| Small finance/billing team (<10 users) | Manual provisioning acceptable, but SSO requires Enterprise pricing |
| Growing SaaS with frequent billing team changes | Use Stitchflow: Okta-only SCIM limits your IdP choices |
| Multi-site billing operations | Use Stitchflow: one IdP per site restriction creates operational complexity |
| Enterprise requiring MFA compliance | Use Stitchflow: native 2FA disabled when SSO enabled |
| Teams using Entra ID or Google Workspace | Use Stitchflow: no documented SCIM support outside Okta |
The bottom line
Chargebee's subscription billing platform offers SCIM provisioning only through Okta's connector, leaving Entra ID and Google Workspace users with manual provisioning. The Enterprise pricing requirement for SSO and the limitation of one IdP per site create additional barriers. For billing teams that need reliable automation across any IdP, Stitchflow eliminates these constraints at predictable pricing.
Make Chargebee workflows AI-native
Chargebee has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.
Technical specifications
SCIM Version
Not specifiedSupported Operations
Not specifiedSupported Attributes
Plan requirement
Not specifiedPrerequisites
Not specifiedKey limitations
- Enterprise plan required for SAML SSO
- Only one IdP can be configured per Chargebee site
- Enabling SAML disables 2FA in Chargebee
- Manual provisioning in Chargebee itself (SCIM via Okta)
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Docs
Enterprise required for SCIM
Use Stitchflow for automated provisioning.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Enterprise required for SCIM
Use Stitchflow for automated provisioning.
Unlock SCIM for
Chargebee
Chargebee has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.
See how it works


