Summary and recommendation
Deel supports SCIM provisioning through Okta, Azure AD, and JumpCloud, but only on their Enterprise tier with custom pricing. Here's the catch: Deel is primarily designed as an HR source system that pushes employee data to your identity provider, rather than receiving provisioning from it. While SCIM works bidirectionally, most organizations use Deel to automatically create accounts in their IdP for new EOR employees and contractors, then provision those identities to downstream applications.
This creates a unique challenge for IT teams managing global workforces. If you're using Deel as your HR system of record, you need SCIM integration to maintain consistent identity management across your stack. But Enterprise pricing for a global HR platform can be substantial, especially when you factor in per-employee costs for payroll processing ($19-29/month US, $599/month for EOR employees). For smaller teams that primarily need contractor management, the pricing gap between basic contractor plans and Enterprise SCIM access creates a significant barrier.
The strategic alternative
Deel gates SCIM behind Enterprise. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across the rest of your stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Official docs |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ✓ | Gallery app with SCIM |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Deel accounts manually. Here's what that costs:
The Deel pricing problem
Deel gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Plan Structure
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| HR Free | Free | ||
| Contractor Management | $49/month | ||
| Global Payroll | $29/employee/month | ||
| US Payroll | $19/employee/month | ||
| EOR Services | $599/month | ||
| Enterprise | Custom pricing |
Note: All lower tiers lack both SSO and SCIM capabilities. Enterprise is the only tier that includes SAML 2.0 SSO with full SCIM provisioning support.
What this means in practice
Deel's Enterprise pricing is custom and typically involves significant minimum commitments. Organizations using Deel for:
The pricing gap becomes particularly painful for companies using Deel's lower-cost contractor management or payroll services who still need enterprise-grade identity management.
Additional constraints
Summary of challenges
- Deel supports SCIM but only at Enterprise tier (custom pricing)
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Deel doesn't sell SCIM separately. It's bundled with Enterprise-level features across their global HR platform:
Here's the reality: Deel is primarily a global HR and payroll platform, not just an app you're provisioning into. Most organizations use Deel as their HR source system—meaning it pushes employee data TO your IdP, not the other way around. The SCIM integration is designed for bidirectional sync to keep your identity provider updated with workforce changes from Deel's HR records.
Stitchflow Insight
If you're already using Deel for global workforce management, the Enterprise tier makes sense. If you're evaluating Deel just for basic app provisioning, you're looking at the wrong solution entirely. We estimate ~80% of Deel's platform is built for complex global HR scenarios that most companies provisioning standard SaaS apps don't need.
What IT admins are saying
Community sentiment on Deel's SCIM implementation is mixed, with admins appreciating the functionality but noting important architectural considerations.
- SCIM works well but requires understanding that Deel often acts as the HR source system
- Enterprise pricing requirement creates barriers for smaller organizations
- JumpCloud users must use generic SAML for SSO since SCIM integration is separate
- Confusion around bidirectional sync when Deel is pushing employee data to IdPs
Deel SCIM is solid for global workforce provisioning, but you need to architect your identity flows carefully since it's often the source of truth for employee data, not the target.
The enterprise pricing gate is frustrating when you just want basic user lifecycle automation for a small global team.
The recurring theme
Deel's SCIM works as designed, but IT teams need to understand it's frequently an HR source system pushing data upstream rather than receiving provisioning commands downstream.
The decision
| Your Situation | Recommendation |
|---|---|
| Need SCIM but not ready for Enterprise pricing | Use Stitchflow: get provisioning without the enterprise commitment |
| Already on Enterprise with SCIM included | Use native SCIM: you're paying for it, leverage the full integration |
| Deel as HR source system, need downstream provisioning | Use native SCIM: Deel → IdP → other apps is the intended flow |
| Small global team, occasional contractor onboarding | Manual may work: but watch for compliance gaps with EOR employees |
| Need SCIM across multiple HR/payroll systems | Use Stitchflow: unified provisioning regardless of your Deel plan |
The bottom line
Deel gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the Deel workflow gap
Deel gates SCIM behind Enterprise, but the bigger issue is the workflow around it. Stitchflow builds and maintains the offboarding, access review, or license workflow underneath.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
SSO must be configured first
Key limitations
- JumpCloud integration is SCIM only (SSO via generic SAML)
- Syncs EOR employees, contractors, and direct employees
- HR field changes sync automatically
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
Deel HR available in OIN. SCIM syncs employee data FROM Deel TO Okta for downstream provisioning. Enables profile sourcing. userName mapped to work email in Deel HR.
Deel gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).
Configuration steps
Set Provisioning Mode = Automatic, configure SCIM connection.
Provisioning trigger
Entra provisions based on user/group assignments to the enterprise app.
Sync behavior
Entra provisioning runs on a scheduled cycle (typically every 40 minutes).
SAML 2.0 SSO with Azure. SCIM provisioning via Developer Center API. Simplifies IT tasks like user provisioning/deprovisioning and identity management.
Deel gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the workflow gap in
Deel
Deel gates SCIM behind Enterprise plan. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across your stack.
Start with the free gap diagnostic
