Stitchflow
Emma logo

Emma SCIM guide

Connector Only

How to automate Emma user provisioning, and what it actually costs

Summary and recommendation

Emma, Marigold's email marketing platform, does not offer SCIM provisioning on any plan. While Emma provides SAML 2.0 SSO integration (IdP-initiated only), this only handles authentication, not user lifecycle management. IT teams face a dual provisioning burden: users must be manually created in both their identity provider and Emma separately. Even worse, Emma's SSO implementation has a critical security gap—existing users who had passwords set before SSO was enabled can bypass SSO entirely and log in with their old credentials.

This manual provisioning requirement creates significant operational overhead for marketing teams and agencies managing Emma access. Without automated provisioning, IT administrators must coordinate user creation across two systems for every onboarding and offboarding event. The bypass vulnerability means organizations cannot enforce consistent authentication policies, creating compliance risks for companies with strict identity governance requirements.

The strategic alternative

Stitchflow provides SCIM-level provisioning through resilient browser automation for Emma without requiring any custom development work. Works with any Emma plan and any identity provider (Okta, Entra ID, Google Workspace, OneLogin). Flat pricing under $5K/year, regardless of team size.

Quick SCIM facts

SCIM available?No
SCIM tier requiredN/A
SSO required first?No
SSO available?Yes
SSO protocolSAML 2.0 (IdP-initiated only)
DocumentationNot available

Supported identity providers

IdPSSOSCIMNotes
OktaVia third-partySSO via SWA only (no SAML/OIDC federation). No SCIM provisioning. Users must be created manually in Emma.
Microsoft Entra IDVia third-partyNo Azure AD/Entra ID integration documented. OneLogin provides SAML and provisioning support.
Google WorkspaceVia third-partyNo native support
OneLoginVia third-partyNo native support

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Emma accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Emma pricing problem

Emma gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
StarterBasic tier (pricing by audience size)
ProPlus tier (more customization/automation)
BusinessTeams tier (multi-department management)
EnterpriseCustom pricing (contact sales)

Pricing structure

PlanPriceSSOSCIM
StarterBasic tier (pricing by audience size)
ProPlus tier (more customization/automation)
BusinessTeams tier (multi-department management)
EnterpriseCustom pricing (contact sales)

OneLogin exception: OneLogin provides a custom connector that can provision users to Emma, but this requires OneLogin as your IdP and doesn't work with Okta, Entra ID, or Google Workspace.

What this means in practice

Without SCIM provisioning, your IT team faces a double-provisioning workflow:

1. Create user in IdP (Okta/Entra/Google) with Emma access 2. Manually create matching user in Emma with correct permissions 3. Maintain synchronization between both systems for role changes 4. Manual cleanup when users leave or change departments

For a marketing team of 20 users, this represents 40+ manual account operations annually just for basic onboarding/offboarding.

Additional constraints

IdP-initiated SSO only
Users must start from your IdP dashboard, not Emma directly
No JIT provisioning
Users can't be created automatically during first login
Password bypass risk
Existing Emma users with passwords can skip SSO entirely
OneLogin dependency
Automated provisioning only works if you use OneLogin as your primary IdP
No deprovisioning automation
Departed users must be manually removed from Emma

Summary of challenges

  • Emma does not provide native SCIM at any price tier
  • Organizations must rely on third-party tools or manual provisioning
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What Emma actually offers for identity

SAML SSO (Enterprise tier)

Emma supports basic SAML 2.0 integration, but only through IdP-initiated flows:

SettingDetails
ProtocolSAML 2.0 (IdP-initiated only)
Supported IdPsGeneric SAML providers
ConfigurationUpload IdP metadata to Emma
User requirementAccounts must be manually created in Emma first

Critical limitation: Emma's SSO is IdP-initiated only, meaning users cannot log in directly from Emma's login page. They must start from their identity provider dashboard.

OneLogin Special Case

OneLogin provides the only automated provisioning option for Emma:

FeatureOneLogin Integration
SAML SSO✓ Yes
User provisioning✓ Yes (via OneLogin connector)
User deprovisioning✓ Yes
Group syncLimited

This means if you're not using OneLogin as your primary IdP, you're stuck with manual user management.

Okta Integration (SWA only)

The Okta Integration Network listing shows Emma's limitations:

FeatureSupported?
SAML SSO❌ No
OIDC SSO❌ No
SWA (password vaulting)✓ Yes
Create users❌ No
Update users❌ No
Deactivate users❌ No

Translation: Okta can only store and replay passwords for Emma logins—no federated SSO or provisioning.

No Azure AD/Entra Support

Emma has no documented integration with Microsoft's identity platform, making it problematic for organizations standardized on Microsoft 365.

Bottom line: Unless you're using OneLogin specifically, Emma requires manual user creation in both your IdP and Emma's platform—defeating the purpose of centralized identity management.

What IT admins are saying

Emma's lack of automated provisioning forces IT teams into manual workflows:

  • Manual user creation required in both IdP and Emma
  • No JIT provisioning means double the administrative overhead
  • SSO only works after manual account setup is complete
  • OneLogin is the only option for any form of user provisioning

NO native SCIM or JIT provisioning... Users must be created in both IdP and Emma

Technical documentation review

Manual user creation required

Community feedback on provisioning limitations

The recurring theme

Even with SSO configured, IT admins must manually create every Emma account before users can authenticate. This doubles the onboarding work and creates potential access gaps when the manual steps are forgotten.

The decision

Your SituationRecommendation
Small marketing team (<10 users) with OneLoginUse OneLogin's native Emma connector
Marketing team using Okta, Entra ID, or Google WorkspaceUse Stitchflow: no native provisioning available
Growing marketing organization (25+ users)Use Stitchflow: manual user creation doesn't scale
Enterprise with compliance requirementsUse Stitchflow: automation essential for audit trail
Agency managing multiple Emma accountsUse Stitchflow: automation critical for client onboarding

The bottom line

Emma delivers solid email marketing capabilities but completely lacks automated user provisioning—except through OneLogin's proprietary connector. For organizations using any other identity provider or needing scalable user management, Stitchflow eliminates the manual overhead of creating users in two separate systems.

Automate Emma without third-party complexity

Stitchflow delivers SCIM-level provisioning through resilient browser automation, backed by 24/7 human in the loop for Emma at <$5K/year, flat, regardless of team size.

Works alongside or instead of native SCIM
Syncs with your existing IdP (Okta, Entra ID, Google Workspace)
Automates onboarding and offboarding
SOC 2 Type II certified
24/7 human-in-the-loop monitoring
Book a Demo

Technical specifications

SCIM Version

Not specified

Supported Operations

Not specified

Supported Attributes

NO native SCIM or JIT provisioningUsers must be created in both IdP and EmmaIdP-initiated SSO only (not SP-initiated)Existing users can bypass SSO if password was set before SSO enabled

Plan requirement

Not specified

Prerequisites

Not specified

Key limitations

  • NO native SCIM or JIT provisioning
  • Users must be created in both IdP and Emma
  • IdP-initiated SSO only (not SP-initiated)
  • Existing users can bypass SSO if password was set before SSO enabled

Documentation not available.

Configuration for Okta

Integration type

Okta Integration Network (OIN) app

Where to enable

Okta Admin Console → Applications → Emma → Sign On

SSO via SWA only (no SAML/OIDC federation). No SCIM provisioning. Users must be created manually in Emma.

Use Stitchflow for automated provisioning.

Unlock SCIM for
Emma

Emma doesn't offer SCIM. Get an enterprise-grade SCIM endpoint in your IdP, even without native support.

See how it works
Admin Console
Directory
Applications
Emma logo
Emma
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

Campaign Monitor logo

Campaign Monitor

No SCIM

Email Marketing

ProvisioningNot Supported
Manual Cost$11,754/yr

Campaign Monitor, the email marketing platform used by agencies and marketing teams, does not support SCIM provisioning on any plan. While Campaign Monitor offers basic SSO integration through Okta and third-party solutions, there's no documented native SAML or SCIM support. This means IT teams must manually create, update, and remove user accounts - a significant operational burden for organizations managing multiple marketing team members or agency client access. The lack of automated provisioning creates a compliance gap for organizations that need consistent identity governance across their SaaS stack. Without SCIM, departing employees may retain access to sensitive customer data and marketing campaigns, while new team members face delays in getting the access they need. For agencies managing multiple client accounts, this manual process becomes especially problematic when onboarding or offboarding staff across numerous Campaign Monitor instances.

View full guide
Constant Contact logo

Constant Contact

No SCIM

Email Marketing

ProvisioningNot Supported
Manual Cost$11,754/yr

Constant Contact, the email marketing platform, does not support SCIM provisioning on any plan. The platform only offers SAML 2.0 SSO for partner-managed accounts through IdP-initiated authentication—meaning direct customers can't even access SSO functionality. This creates a significant gap for IT teams managing user access to marketing tools, as all user provisioning, deprovisioning, and permission management must be handled manually within Constant Contact's interface. The lack of both SCIM and general SSO availability for direct customers means IT teams have no automated way to enforce access policies or ensure prompt deprovisioning when employees leave. For organizations using Constant Contact across multiple team members (especially on the Premium plan with unlimited users), this manual overhead becomes a compliance and security risk. When marketing teams need quick access to launch campaigns, the manual account creation process creates unnecessary friction.

View full guide
6sense logo

6sense

No SCIM

B2B Revenue Intelligence / ABM

ProvisioningNot Supported
Manual Cost$11,754/yr

6sense, the B2B revenue intelligence platform, has paused SCIM provisioning for new customers until Q4 2026. While existing customers with SCIM enabled can continue using it, new implementations are limited to JIT (Just-In-Time) provisioning through SAML SSO. This creates a significant gap for IT teams managing revenue intelligence access, as JIT only creates users on first login and provides minimal attribute mapping (email, first name, last name only). For an enterprise platform with typical pricing of $55,000-$130,000 annually, the absence of automated user lifecycle management is a substantial limitation. The lack of SCIM until Q4 2026 forces IT teams into manual provisioning workflows for a platform handling sensitive revenue data. While SAML SSO handles authentication, it doesn't address user lifecycle events like role changes, department transfers, or offboarding. This creates compliance risks in revenue teams where access to prospect data and sales intelligence must be tightly controlled. The nearly two-year wait for SCIM restoration means organizations implementing 6sense today face manual user management for the foreseeable future.

View full guide