Summary and recommendation
Code42 (now Mimecast Incydr) supports native SCIM 2.0 provisioning, but only on Enterprise plans starting at ~$90/user/year. The implementation requires Identity Management to be enabled on your tenant and Customer Cloud Admin permissions for setup. While the SCIM integration itself is robust—supporting user lifecycle management, attribute sync, and group-based organization mapping through both Okta and Entra—the Enterprise tier requirement creates a significant cost barrier for mid-market organizations.
For a 100-person team, upgrading from lower tiers to Enterprise just to unlock automated provisioning could cost $108,000+ annually, often for advanced security features beyond basic user management needs. This forces IT teams into an uncomfortable choice: accept the manual overhead of provisioning data loss prevention tools (creating compliance gaps) or pay enterprise premiums primarily for automation capabilities.
The strategic alternative
Code42 gates SCIM behind Enterprise. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across the rest of your stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ✓ | Gallery app with SCIM |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Code42 accounts manually. Here's what that costs:
The Code42 pricing problem
Code42 gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Pro | Custom | ||
| Business | Custom | ||
| Enterprise | ~$90/user/year |
Plan Structure
| Plan | Price | SCIM |
|---|---|---|
| Pro | Custom | ❌ |
| Business | Custom | ❌ |
| Enterprise | ~$90/user/year | ✓ |
Note: Code42 uses custom pricing across all tiers, but Enterprise typically starts around $90 per user annually based on market data.
What this means in practice
The Enterprise upgrade represents a substantial investment for teams requiring automated provisioning:
| Team Size | Annual Enterprise Cost | Monthly Cost |
|---|---|---|
| 50 users | ~$54,000/year | ~$4,500/mo |
| 100 users | ~$108,000/year | ~$9,000/mo |
| 200 users | ~$216,000/year | ~$18,000/mo |
Organizations on Pro or Business plans face an all-or-nothing upgrade decision - there's no middle tier with basic SCIM capabilities.
Additional constraints
Summary of challenges
- Code42 supports SCIM but only at Enterprise tier (Custom (~$90/user/year base))
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Code42 (now Mimecast Incydr) doesn't sell SCIM separately. It's bundled with Enterprise-tier features that cost ~$90/user/year:
The platform requires significant setup - you need Customer Cloud Admin permissions and Identity Management enabled on your tenant. Code42's acquisition by Mimecast has also created complexity with two separate Okta integrations (Code42 cloud and Single Tenant versions).
Stitchflow Insight
If you need comprehensive data protection and insider risk management, the Enterprise upgrade delivers value. If you just want automated user provisioning for basic endpoint backup, you're paying for enterprise security features you likely won't use. We estimate ~60% of Enterprise features are overkill for teams that only need SCIM provisioning.
What IT admins are saying
Community sentiment on Code42's SCIM implementation is mixed, with concerns about the enterprise-only requirement and post-acquisition uncertainty. Common complaints:
- Being locked into expensive Enterprise plans just for SCIM provisioning
- Confusion around the Mimecast acquisition and product transitions
- Complex setup requirements needing Customer Cloud Admin permissions
- Multiple Okta apps creating integration confusion (Code42 cloud vs Single Tenant)
The acquisition by Mimecast has created a lot of uncertainty about the future roadmap and pricing structure.
Why do we need Enterprise just for basic user provisioning? The ~$90/user/year jump is steep when you just want automated onboarding.
The recurring theme
While Code42 offers solid SCIM support, the Enterprise tier requirement and post-acquisition uncertainty make it an expensive proposition for teams that just need reliable user provisioning.
The decision
| Your Situation | Recommendation |
|---|---|
| On Pro/Business plan, need SCIM | Use Stitchflow: avoid the Enterprise upgrade and ~$90/user/year commitment |
| Already on Enterprise with Identity Management enabled | Use native SCIM: you're paying for it and it's full SCIM 2.0 |
| Small team, low employee churn | Manual provisioning may work: but watch for security gaps |
| Need Enterprise features beyond SCIM | Evaluate Enterprise: SCIM comes bundled with the tier |
| Using legacy Code42 (pre-Mimecast acquisition) | Plan migration strategy: product is now Mimecast Incydr |
The bottom line
Code42 gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the Code42 workflow gap
Code42 gates SCIM behind Enterprise, but the bigger issue is the workflow around it. Stitchflow builds and maintains the offboarding, access review, or license workflow underneath.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
None
Key limitations
- Requires Identity Management to be enabled on Code42 tenant
- Requires Customer Cloud Admin permission for setup
- Code42 was acquired by Mimecast - product now called Mimecast Incydr
- Two apps in Okta: Code42 (cloud) and Code42 Single Tenant
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
Docs
Code42 has full SCIM 2.0 support via Okta OIN. Supports user creation, updates, deactivation, and organization mapping based on SCIM groups.
Code42 gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app with SCIM provisioning
Where to enable
Required credentials
Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).
Configuration steps
Set Provisioning Mode = Automatic, configure SCIM connection.
Provisioning trigger
Entra provisions based on user/group assignments to the enterprise app.
Sync behavior
Entra provisioning runs on a scheduled cycle (typically every 40 minutes).
Full SCIM provisioning with Entra. Supports user creation, deactivation, attribute sync, and group provisioning.
Code42 gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the workflow gap in
Code42
Code42 gates SCIM behind Enterprise plan. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across your stack.
Start with the free gap diagnostic
