Stitchflow
Datto logo

Datto SCIM guide

Native SCIM

How to automate Datto user provisioning, and what it actually costs

Native SCIM requires Enterprise/Partner plan

Summary and recommendation

Datto offers SCIM provisioning exclusively through Okta's Partner Portal integration—a narrow solution that only addresses MSP partner access, not the broader user management needs across Datto's ecosystem of RMM, Workplace, and backup products. While Datto supports SAML 2.0 SSO for RMM and Workplace, these require manual user creation with matching email addresses between your IdP and Datto systems. The SSO implementation also requires certificate management, with the current RMM certificate expiring in September 2026.

For MSPs managing multiple Datto products, this creates a fragmented provisioning experience where Partner Portal users flow automatically through SCIM, but technicians accessing RMM or Workplace must be manually provisioned despite having SSO authentication. This hybrid approach leaves IT teams managing users across multiple interfaces while maintaining email synchronization between systems—exactly the type of manual overhead that automated provisioning should eliminate.

The strategic alternative

Datto gates SCIM behind Enterprise/Partner. Skip the Enterprise/Partner plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredEnterprise
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDSSO only
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Datto accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Datto pricing problem

Datto gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
Partner PortalSCIM via Okta
Okta subscription, Partner status
RMMSAML SSO only
Manual user creation, certificate management
WorkplaceSAML SSO only
Manual user creation, matching email addresses
BackupManual

Provisioning structure

ProductProvisioning MethodRequirements
Partner PortalSCIM via OktaOkta subscription, Partner status
RMMSAML SSO onlyManual user creation, certificate management
WorkplaceSAML SSO onlyManual user creation, matching email addresses
BackupManualNo automation available

Key limitation: SCIM provisioning is restricted to the Partner Portal and requires Okta. The core Datto products that MSPs use daily (RMM, Workplace) only support SAML SSO with manual user creation.

What this means in practice

For MSPs managing multiple Datto products

Technicians need manual account creation across RMM, Workplace, and Backup
User attributes and group assignments can't sync automatically
Offboarding requires manual deactivation in each product
SSO certificates expire (Sept 2026 for RMM) and need manual renewal

For non-Okta environments

No SCIM provisioning available at all
Pure SAML SSO with manual account management
Users must be pre-created with matching email addresses

Additional constraints

Multi-product complexity
Different authentication methods across Datto's product suite
Certificate management burden
SSO certificates require periodic manual updates
Partner Portal limitation
SCIM only available for partner-facing portal, not operational tools
Email matching requirement
Users must exist in both Workplace and IdP with identical email addresses
Okta dependency
SCIM provisioning locked to Okta integration only

Summary of challenges

  • Datto supports SCIM but only at Enterprise tier (custom pricing)
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What Datto actually offers for identity

SCIM Provisioning (Partner Portal via Okta only)

Datto's SCIM support is limited to their Partner Portal and exclusively available through Okta:

FeatureSupported?
Create users✓ Yes (Partner Portal only)
Update attributes✓ Yes (Partner Portal only)
Deactivate users✓ Yes (Partner Portal only)
Group management✓ Yes (via Okta Group Linking)
Multi-product access❌ No (Partner Portal only)

Critical limitation: SCIM provisioning only works for the Datto Partner Portal through Okta's Integration Network. This doesn't cover Datto's main products like RMM, Workplace, or Backup solutions.

SAML SSO (RMM and Workplace)

For Datto's core products, you're limited to SAML 2.0 authentication:

SettingDetails
ProtocolSAML 2.0
Supported productsRMM, Workplace
IdP supportOkta, Azure AD, ADFS, generic SAML
User requirementMust exist in both Workplace and IdP with matching emails
Certificate managementRequired - expires September 2026

Why this falls short: You get basic federated login but no automated user management. For MSPs managing dozens of technicians across multiple Datto products, you're still manually creating and managing accounts in each system.

The reality is that most MSPs need provisioning across Datto's entire product suite (RMM, Backup, Workplace), not just the Partner Portal. With certificate renewals required by 2026 and no SCIM for core products, you're looking at ongoing manual overhead for what should be automated identity management.

What IT admins are saying

Datto's fragmented provisioning approach creates challenges for MSP IT teams managing multiple products:

  • SCIM only works for Partner Portal through Okta, leaving RMM and Workplace users to manage manually
  • SSO certificates require regular updates - RMM certificate expires September 2026
  • Users must be pre-created in both Workplace and your IdP with matching email addresses
  • Multi-product access means separate provisioning workflows across Datto's suite

Users must exist in both Workplace and IdP with matching emails

Datto Workplace documentation

RMM SSO certificate expires Sept 2026

Datto RMM SSO configuration

The recurring theme

Even though Datto offers SCIM for Partner Portal, MSPs still face manual user management across RMM and Workplace products, plus ongoing certificate maintenance for SSO functionality.

The decision

Your SituationRecommendation
Small MSP (<10 technicians) using basic Datto productsManual management with SAML SSO is sufficient
Growing MSP using Okta with Partner Portal accessNative Okta SCIM integration works well
Large MSP (25+ technicians) across multiple Datto productsUse Stitchflow: automation across RMM, Workplace, and Backup
Enterprise MSP with compliance requirementsUse Stitchflow: automation essential for audit trail
MSP using Entra ID or Google WorkspaceUse Stitchflow: native SCIM only available via Okta

The bottom line

Datto's SCIM provisioning is limited to the Partner Portal via Okta, leaving RMM and Workplace products requiring manual user management. For MSPs managing large technician teams across multiple Datto products or using non-Okta identity providers, Stitchflow provides comprehensive automation without the Okta dependency.

Make Datto workflows AI-native

Datto gates SCIM behind Enterprise/Partner. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.

No Enterprise/Partner upgrade required
Less than a week, start to finish (~2 hours of your time)
We maintain the integration layer underneath
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Enterprise

Prerequisites

SSO must be configured first

Key limitations

  • SCIM primarily for Partner Portal via Okta
  • RMM SSO certificate expires Sept 2026
  • Users must exist in both Workplace and IdP with matching emails

Configuration for Okta

Integration type

Okta Integration Network (OIN) app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Okta Admin Console → Applications → Datto → Provisioning

Required credentials

SCIM endpoint URL and bearer token (generated in app admin console).

Configuration steps

Enable Create Users, Update User Attributes, and Deactivate Users.

Provisioning trigger

Okta provisions based on app assignments (users or groups).

Datto Partner Portal available in OIN. Supports Group Linking, Schema Discovery, Attribute Writeback.

Datto gates SCIM behind Enterprise/Partner. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Unlock SCIM for
Datto

Datto gates SCIM behind Enterprise/Partner plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.

See how it works
Admin Console
Directory
Applications
Datto logo
Datto
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

ConnectWise logo

ConnectWise

No SCIM

MSP / IT Service Management

ProvisioningNot Supported
Manual Cost$11,754/yr

ConnectWise, the MSP platform suite, does not offer native SCIM provisioning across any of its products (Manage, Control, Automate). While SCIM provisioning is available through Okta's OIN integration on enterprise plans, this creates vendor lock-in and leaves teams using other identity providers like Entra ID or Google Workspace without automated provisioning options. The lack of native SCIM is particularly problematic for MSPs managing multiple ConnectWise products, as each requires separate SSO configurations and manual user management across the entire suite. This gap creates significant operational overhead for growing MSPs. Without SCIM, IT teams must manually provision and deprovision technicians across multiple ConnectWise products when onboarding new hires or managing role changes. For MSPs with high technician turnover or seasonal staffing, this manual process becomes a compliance risk and productivity drain. SSO alone doesn't solve the problem—it only handles authentication, not the critical user lifecycle management needed for proper access governance.

View full guide
8x8 logo

8x8

SCIM Tax

UCaaS / Business Communications

SCIM StatusIncluded
Manual Cost$11,754/yr

8x8 supports SCIM 2.0 for automated user provisioning, but only on their quote-based X Series plans (previously $24-44/user/month range before they moved to custom pricing). While SCIM can create, update, and deactivate users, it has critical gaps that create ongoing manual overhead: license assignment must be done manually after every user is provisioned, users can't be deleted (only deactivated), and provisioned users don't automatically appear in the Company Directory. For IT teams managing a unified communications platform that typically covers all employees, these limitations defeat much of SCIM's purpose. You're still manually touching every user account to assign licenses and ensure directory visibility. The lack of user deletion support also creates compliance headaches when employees leave - accounts accumulate as "deactivated" rather than being properly removed.

View full guide
Absorb LMS logo

Absorb LMS

SCIM Tax

Learning Management System (LMS)

SCIM StatusIncluded
Manual Cost$11,754/yr

Absorb LMS supports native SCIM provisioning, but only on Enterprise plans with SSO as a required paid add-on. Even with SCIM enabled, the implementation has critical limitations: SAML provisioning only creates accounts on first login and never updates existing users, and full user provisioning requires the specific "Absorb 5 - New Learner Experience" version. For organizations managing compliance training across hundreds or thousands of learners, these gaps create ongoing manual work. The SSO-as-add-on model means you're paying extra fees on top of already custom Enterprise pricing ($6-12/user/month base, but varies significantly). For learning management systems handling external partners, contractors, and employees across different access levels, the inability to update existing user attributes through SAML provisioning forces IT teams into manual account management—exactly what automated provisioning should eliminate.

View full guide