Summary and recommendation
Expel, the managed detection and response (MDR) platform, does not offer SCIM provisioning on any plan. Despite supporting SAML SSO integration with identity providers like Okta and Entra ID, Expel requires manual user provisioning for all account creation and lifecycle management. This creates a significant operational burden for IT teams managing security operations centers (SOCs) where analyst turnover is notoriously high and rapid onboarding/offboarding is critical for maintaining security posture.
The lack of automated provisioning in a security platform creates compliance risks and operational inefficiencies. Security teams frequently rotate personnel, contractors, and temporary analysts based on threat landscapes and incident response needs. Manual provisioning delays mean new analysts can't access critical security data immediately, while delayed deprovisioning leaves former employees with access to sensitive threat intelligence and security tooling longer than necessary.
The strategic alternative
Expel has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.
Quick SCIM facts
| SCIM available? | No |
| SCIM tier required | N/A |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ❌ | Custom SAML integration |
| Microsoft Entra ID | ✓ | ❌ | Custom SAML integration |
| Google Workspace | Via third-party | ❌ | No native support |
| OneLogin | Via third-party | ❌ | No native support |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Expel accounts manually. Here's what that costs:
The Expel pricing problem
Expel gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Custom | Quote-based |
Pricing and provisioning matrix
| Plan | Pricing | SCIM Support | SSO Support |
|---|---|---|---|
| Custom | Quote-based | ❌ Not available | ✓ SAML (custom integration) |
Expel operates on entirely custom pricing with no publicly available rates. All provisioning must be handled manually through their web interface, regardless of contract size.
What this means in practice
Manual provisioning requirements
Operational impact for security teams
Additional constraints
Summary of challenges
- Expel does not provide native SCIM at any price tier
- Organizations must rely on third-party tools or manual provisioning
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Expel actually offers for identity
SAML SSO (Custom Implementation)
Expel supports SAML 2.0 integration for single sign-on authentication:
| Setting | Details |
|---|---|
| Protocol | SAML 2.0 |
| Supported IdPs | Okta, Entra ID, Google Workspace, custom SAML providers |
| Configuration | Custom SAML integration setup |
| Pricing requirement | Enterprise plan (custom pricing) |
| User management | Manual provisioning required |
Critical limitation: Expel's SAML implementation only handles authentication. All user provisioning, deprovisioning, and attribute updates must be handled manually through the Expel platform.
No Provisioning Capabilities
Expel does not offer any automated user provisioning:
| Feature | Supported? |
|---|---|
| Create users | ❌ No |
| Update user attributes | ❌ No |
| Deactivate users | ❌ No |
| Group management | ❌ No |
| Role assignment | ❌ Manual only |
The real-world impact: IT teams must maintain dual user management - handling authentication through their IdP while manually creating, updating, and removing users in Expel's security platform. For security teams that need rapid onboarding and offboarding, this creates operational overhead and potential security gaps.
What IT admins are saying
Expel's lack of automated provisioning forces IT teams into manual workflows that don't scale:
- Manual user creation required for every new employee
- No way to automatically sync user attributes or group memberships
- Deprovisioning must be handled manually when employees leave
- SSO works but doesn't eliminate the provisioning burden
We have SSO working with Expel through SAML, but I still have to create every user account manually. It's frustrating when you're trying to automate everything else in your security stack.
The lack of SCIM support means Expel is always going to be a manual touchpoint in our onboarding process. For a security platform, you'd expect better integration capabilities.
The recurring theme
While Expel supports SSO authentication, the absence of SCIM means IT teams must maintain a separate manual process for user lifecycle management - creating operational overhead that scales poorly with organization growth.
The decision
| Your Situation | Recommendation |
|---|---|
| Small security team (<10 users) with stable staffing | Manual management with SAML SSO is manageable |
| Mid-size organization (10-50 users) with regular security team changes | Use Stitchflow: manual provisioning becomes error-prone |
| Enterprise security operations (50+ users) | Use Stitchflow: automation essential for scale |
| Organizations with strict compliance requirements | Use Stitchflow: automated audit trail and access controls required |
| Multi-team security deployments with SOC analysts | Use Stitchflow: consistent provisioning across teams is critical |
The bottom line
Expel provides enterprise-grade managed detection and response, but offers no SCIM provisioning capabilities whatsoever. Security teams managing multiple analysts, contractors, and stakeholders face ongoing manual user management overhead. For organizations that need automated provisioning without the complexity of custom API integrations, Stitchflow delivers SCIM-level automation for security-critical applications.
Make Expel workflows AI-native
Expel has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.
Technical specifications
SCIM Version
Not specifiedSupported Operations
Not specifiedSupported Attributes
Plan requirement
Not specifiedPrerequisites
Not specifiedKey limitations
- No SCIM support available
- Manual user provisioning required
- SSO available via SAML
Documentation not available.
Unlock SCIM for
Expel
Expel has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.
See how it works


