Stitchflow
Cloudflare logo

Cloudflare SCIM guide

Native SCIM

How to automate Cloudflare user provisioning, and what it actually costs

Native SCIM requires Enterprise plan

Summary and recommendation

Cloudflare supports SCIM for automated user provisioning, but only on Enterprise plans with custom pricing. The integration works with just two identity providers (Okta and Microsoft Entra ID), leaving Google Workspace and OneLogin users without native provisioning options. Even more problematic: SCIM Virtual Groups are being discontinued in December 2025, forcing teams to rebuild their group-based access policies using alternative methods.

For security teams, this creates a significant gap. Cloudflare's Zero Trust platform (Access and Gateway) is designed to protect network access and web traffic based on user identity - but without reliable provisioning from other IdPs, you're stuck with manual user management or risky workarounds. SSO alone doesn't solve this: users may authenticate successfully but lack proper group memberships for policy enforcement, or worse, remain active in Cloudflare after being deactivated in your IdP.

The strategic alternative

Cloudflare gates SCIM behind Enterprise. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across the rest of your stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredEnterprise
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0, OIDC
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDGallery app with SCIM
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Cloudflare accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Cloudflare pricing problem

Cloudflare gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Plan Structure

PlanPriceSSOSCIM
Free$0/mo (up to 50 Zero Trust users)
Zero Trust Standard$7/user/mo
Access Only$3/user/mo
Gateway Only$5/user/mo
EnterpriseCustom pricing

Note: CDN and website security services are priced separately per domain. SCIM is exclusively available on Enterprise plans.

What this means in practice

Without transparent Enterprise pricing, teams face uncertainty when budgeting for SCIM access:

Known challenges

No self-serve Enterprise option
requires sales engagement
Custom pricing typically means significant premium over standard tiers
Based on industry patterns, Enterprise could be 3-5x higher than Standard pricing

Upgrade impact estimate for Zero Trust Standard → Enterprise

Team SizeEst. Annual Premium
50 users$10,000 - $25,000+
100 users$20,000 - $50,000+
200 users$40,000 - $100,000+

Additional constraints

Limited IdP support
Only Okta and Microsoft Entra ID are supported for SCIM - no Google Workspace, OneLogin, or other providers.
Nested groups unsupported
Complex organizational structures requiring nested group management won't work with Cloudflare's SCIM implementation.
SCIM Virtual Groups end-of-life
Current SCIM Virtual Groups functionality expires December 2025, forcing migration planning.
Super Administrator requirement
Initial SCIM setup requires Super Admin privileges, creating security and access management complications.
Sales dependency
No self-serve Enterprise access means lengthy sales cycles for what should be a straightforward provisioning requirement.

Summary of challenges

  • Cloudflare supports SCIM but only at Enterprise tier (Custom pricing (includes SCIM))
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

Cloudflare doesn't sell SCIM separately. It's exclusively bundled with Enterprise plans that include extensive security and networking features:

SCIM automated provisioning (Okta and Microsoft Entra only)
Advanced Zero Trust controls (Access and Gateway)
Enhanced DDoS protection and WAF
Custom SSL certificates and security rules
Priority support and SLA guarantees
Advanced analytics and reporting
API rate limiting and bot management
Load balancing and traffic steering

The reality: if you're primarily using Cloudflare for CDN and basic security, roughly 80% of Enterprise features are overkill for teams that simply need user provisioning. You're paying enterprise rates for network infrastructure capabilities when you just want to sync users from your IdP.

The bigger limitation: SCIM only works with two identity providers (Okta and Microsoft Entra). Teams using Google Workspace, OneLogin, or other IdPs are locked out entirely, regardless of what they're willing to pay.

What IT admins are saying

Community sentiment on Cloudflare's SCIM implementation is mixed, with frustration centered on pricing barriers and IdP limitations. Common complaints:

  • Being locked into Enterprise pricing just for basic user provisioning
  • Limited to only Okta and Microsoft Entra ID (no Google Workspace support)
  • Lack of nested group support for complex organizational structures
  • SCIM Virtual Groups being discontinued in December 2025

The Enterprise requirement is frustrating when you just need basic SCIM for a small security team. We're paying for features we don't use.

IT Admin, Reddit

Only supporting two IdPs in 2024 feels really limiting. We're stuck because we use Google Workspace.

DevOps Engineer, HackerNews

The recurring theme

Essential security automation is gated behind enterprise pricing, while IdP support limitations force infrastructure decisions around Cloudflare's constraints rather than organizational needs.

The decision

Your SituationRecommendation
Not on Enterprise, need SCIMUse Stitchflow: avoid the Enterprise upgrade costs
Already on EnterpriseUse native SCIM: you're paying for it
Only using Okta or Entra IDNative SCIM works: but watch for nested group limitations
Need Google Workspace or OneLogin supportUse Stitchflow: native SCIM only supports two IdPs
Complex group structures with nestingUse Stitchflow: native doesn't support nested groups

The bottom line

Cloudflare gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.

Close the Cloudflare workflow gap

Cloudflare gates SCIM behind Enterprise, but the bigger issue is the workflow around it. Stitchflow builds and maintains the offboarding, access review, or license workflow underneath.

Across every app in the workflow, including the ones without APIs
Built in less than a week, with roughly 2 hours from your team
You review the exceptions. Stitchflow maintains the workflow underneath
Start with the free gap diagnostic

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Enterprise

Prerequisites

SSO must be configured first

Key limitations

  • Enterprise only
  • Only Okta and Microsoft Entra supported
  • Nested groups not supported
  • SCIM Virtual Groups end-of-life Dec 2025
  • Super Administrator required for initial setup

Configuration for Okta

Integration type

Okta Integration Network (OIN) app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Okta Admin Console → Applications → Cloudflare → Provisioning

Required credentials

SCIM endpoint URL and bearer token (generated in app admin console).

Configuration steps

Enable Create Users, Update User Attributes, and Deactivate Users.

Provisioning trigger

Okta provisions based on app assignments (users or groups).

SCIM provisioning for Cloudflare One (Access/Gateway). Supports user and group sync. Only Okta and Microsoft Entra ID are supported for SCIM.

Cloudflare gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Cloudflare → Provisioning

Required credentials

Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).

Configuration steps

Set Provisioning Mode = Automatic, configure SCIM connection.

Provisioning trigger

Entra provisions based on user/group assignments to the enterprise app.

Sync behavior

Entra provisioning runs on a scheduled cycle (typically every 40 minutes).

Native SCIM integration for Microsoft Entra ID. Auto-deprovision when users deactivated in IdP.

Cloudflare gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.

Close the workflow gap in
Cloudflare

Cloudflare gates SCIM behind Enterprise plan. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across your stack.

Start with the free gap diagnostic
Admin Console
Directory
Applications
Cloudflare logo
Cloudflare
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

8x8 logo

8x8

SCIM Tax

UCaaS / Business Communications

SCIM StatusIncluded
Manual Cost$11,754/yr

8x8 supports SCIM 2.0 for automated user provisioning, but only on their quote-based X Series plans (previously $24-44/user/month range before they moved to custom pricing). While SCIM can create, update, and deactivate users, it has critical gaps that create ongoing manual overhead: license assignment must be done manually after every user is provisioned, users can't be deleted (only deactivated), and provisioned users don't automatically appear in the Company Directory. For IT teams managing a unified communications platform that typically covers all employees, these limitations defeat much of SCIM's purpose. You're still manually touching every user account to assign licenses and ensure directory visibility. The lack of user deletion support also creates compliance headaches when employees leave - accounts accumulate as "deactivated" rather than being properly removed.

View full guide
Absorb LMS logo

Absorb LMS

SCIM Tax

Learning Management System (LMS)

SCIM StatusIncluded
Manual Cost$11,754/yr

Absorb LMS supports native SCIM provisioning, but only on Enterprise plans with SSO as a required paid add-on. Even with SCIM enabled, the implementation has critical limitations: SAML provisioning only creates accounts on first login and never updates existing users, and full user provisioning requires the specific "Absorb 5 - New Learner Experience" version. For organizations managing compliance training across hundreds or thousands of learners, these gaps create ongoing manual work. The SSO-as-add-on model means you're paying extra fees on top of already custom Enterprise pricing ($6-12/user/month base, but varies significantly). For learning management systems handling external partners, contractors, and employees across different access levels, the inability to update existing user attributes through SAML provisioning forces IT teams into manual account management—exactly what automated provisioning should eliminate.

View full guide
Airbase logo

Airbase

SCIM Tax

Spend Management / Corporate Cards

SCIM StatusIncluded
Manual Cost$11,754/yr

Airbase supports SCIM provisioning, but only on Enterprise plans starting around $8,500/year. While SCIM works with all major identity providers (Okta, Entra ID, Google Workspace), the Enterprise requirement creates a significant barrier for smaller finance teams who need automated provisioning for spend management but can't justify enterprise-level spend management software costs. This creates a particular challenge in finance applications where rapid provisioning and deprovisioning is critical for corporate card access and financial controls. Manual user management means delayed access for new employees needing corporate cards, and more critically, potential security gaps when departing employees retain access to spend management systems. For finance teams handling sensitive financial data and corporate spending, these delays and oversights create both operational friction and compliance risks.

View full guide