Stitchflow
Expensify logo

Expensify SCIM guide

Native SCIM

How to automate Expensify user provisioning, and what it actually costs

Native SCIM requires Control Plan plan

Summary and recommendation

Expensify offers SCIM provisioning, but only through their Okta integration on the Control plan ($9/user/month with Expensify Card, $18/user/month without). The catch: SCIM must be manually activated by emailing concierge@expensify.com, and deactivation only expires user access rather than closing accounts entirely. This creates an operational bottleneck where IT teams can't immediately provision expense management access for new employees without waiting for Expensify's manual intervention.

The manual activation requirement defeats the purpose of automated provisioning. When finance teams need immediate expense access for new hires or contractors, waiting for email support responses creates delays in critical business workflows. Additionally, the incomplete deactivation means former employees retain dormant accounts that could pose compliance risks during audits.

The strategic alternative

Expensify gates SCIM behind Control Plan. Skip the Control Plan plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredCustom
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDSSO only
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Expensify accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Expensify pricing problem

Expensify gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
Starter$4.99/month (individual)
Pro$5/member/month (with card) or $10/member/month
Business$9/member/month (with card) or $18/member/month
ControlContact sales (enterprise pricing)

Pricing and provisioning options

PlanPriceSSOSCIM
Starter$4.99/month (individual)
Pro$5/member/month (with card) or $10/member/month
Business$9/member/month (with card) or $18/member/month
ControlContact sales (enterprise pricing)

What this means in practice

Okta-only SCIM limitation: Even on the Control plan, SCIM provisioning only works through Okta. Organizations using Azure AD, Google Workspace, or OneLogin must handle user provisioning manually, despite paying enterprise-level pricing.

Manual activation process: SCIM isn't automatically enabled on Control plans. IT teams must email concierge@expensify.com to request SCIM API activation, adding delays to deployment timelines.

Incomplete deactivation: When SCIM deactivates users, it only expires their access rather than properly closing accounts, leaving potential security gaps and license waste.

Additional constraints

Single IdP dependency
SCIM provisioning is locked to Okta, forcing manual workflows for all other identity providers
Email-based activation
No self-service SCIM setup; requires support ticket and manual intervention from Expensify's team
Certificate limitations
Only one active SAML certificate supported, complicating multi-environment setups
Plan upgrade requirement
Organizations need expensive Control plan pricing just to access basic provisioning features

Summary of challenges

  • Expensify supports SCIM but only at Custom tier (Control plan - contact sales for volume pricing)
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

Expensify doesn't sell SCIM separately. It's bundled with Control plan enterprise features:

SCIM automated provisioning (Okta only, requires manual activation)
SAML single sign-on with domain verification
Advanced approval workflows and multi-level chains
Corporate card reconciliation and bill pay
Custom expense categories and advanced reporting
Accounting integrations (QuickBooks, NetSuite, etc.)
Receipt forwarding and mileage tracking
Dedicated concierge support

The Control plan costs $9/user/month with the Expensify Card bundle, or $18/user/month without it. You're essentially paying for a comprehensive expense management platform when you might only need user provisioning.

The friction factor: Even after upgrading, SCIM isn't automatically enabled. You must email concierge@expensify.com to request API activation, and it only works with Okta. For organizations using Azure AD or Google Workspace, you're paying Control plan pricing but still managing users manually.

Stitchflow Insight

We estimate ~60% of Control plan features are expense management tools irrelevant for teams that primarily need automated user provisioning across multiple identity providers.

What IT admins are saying

Community sentiment on Expensify's SCIM implementation is frustrated, particularly around the manual activation requirement and Okta-only limitation. Common complaints:

  • Having to email support to activate SCIM despite paying for Control plan
  • SCIM only working with Okta, forcing manual provisioning for other IdPs
  • Deactivated users keeping dormant accounts instead of proper closure
  • Control plan pricing jumps significantly without bundled Expensify Card

SCIM API activation must be requested via concierge@expensify.com

Expensify official documentation

SCIM deactivation doesn't close account, just expires access

Okta integration notes

The recurring theme

Even after upgrading to enterprise pricing, IT teams can't simply enable SCIM through normal admin settings - they're stuck emailing support for basic provisioning features that should be self-service.

The decision

Your SituationRecommendation
Small teams with Okta and time for activation delaysUse native SCIM after emailing concierge@expensify.com for activation
Need immediate deployment for new hiresUse Stitchflow: no waiting for manual activation or support tickets
Using Entra ID, Google Workspace, or OneLoginUse Stitchflow: Expensify's SCIM only works with Okta
Security teams requiring complete account closureUse Stitchflow: native SCIM only expires access, doesn't close accounts
Want to avoid Control plan pricing ($9-18/user/month)Use Stitchflow: build complete workflows across every app in less than a week (~2 hours of your time).

The bottom line

Expensify offers SCIM but gates it behind Control plan pricing and manual activation requests that defeat the purpose of automation. For organizations that need reliable provisioning without email gatekeeping or Okta dependency, Stitchflow delivers immediate deployment across all identity providers.

Make Expensify workflows AI-native

Expensify gates SCIM behind Control Plan. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.

No Control Plan upgrade required
Less than a week, start to finish (~2 hours of your time)
We maintain the integration layer underneath
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Custom

Prerequisites

SSO must be configured first

Key limitations

  • SCIM API activation must be requested via concierge@expensify.com
  • SCIM deactivation doesn't close account, just expires access
  • Only one active SAML certificate supported at a time
  • Control plan required for ADFS SSO

Configuration for Okta

Integration type

Okta Integration Network (OIN) app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Okta Admin Console → Applications → Expensify → Provisioning

Required credentials

SCIM endpoint URL and bearer token (generated in app admin console).

Configuration steps

Enable Create Users, Update User Attributes, and Deactivate Users.

Provisioning trigger

Okta provisions based on app assignments (users or groups).

SCIM API must be activated via concierge@expensify.com. Supports deactivate users (expires access, doesn't close account). Also Aquera connector available.

Expensify gates SCIM behind Control Plan. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Expensify → Single sign-on

SAML SSO supported (SP initiated). User provisioning is manual. Only one active SAML certificate supported at a time. Uses HTTP_POST binding.

Use Stitchflow for automated provisioning.

Unlock SCIM for
Expensify

Expensify gates SCIM behind Control Plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.

See how it works
Admin Console
Directory
Applications
Expensify logo
Expensify
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

8x8 logo

8x8

SCIM Tax

UCaaS / Business Communications

SCIM StatusIncluded
Manual Cost$11,754/yr

8x8 supports SCIM 2.0 for automated user provisioning, but only on their quote-based X Series plans (previously $24-44/user/month range before they moved to custom pricing). While SCIM can create, update, and deactivate users, it has critical gaps that create ongoing manual overhead: license assignment must be done manually after every user is provisioned, users can't be deleted (only deactivated), and provisioned users don't automatically appear in the Company Directory. For IT teams managing a unified communications platform that typically covers all employees, these limitations defeat much of SCIM's purpose. You're still manually touching every user account to assign licenses and ensure directory visibility. The lack of user deletion support also creates compliance headaches when employees leave - accounts accumulate as "deactivated" rather than being properly removed.

View full guide
Absorb LMS logo

Absorb LMS

SCIM Tax

Learning Management System (LMS)

SCIM StatusIncluded
Manual Cost$11,754/yr

Absorb LMS supports native SCIM provisioning, but only on Enterprise plans with SSO as a required paid add-on. Even with SCIM enabled, the implementation has critical limitations: SAML provisioning only creates accounts on first login and never updates existing users, and full user provisioning requires the specific "Absorb 5 - New Learner Experience" version. For organizations managing compliance training across hundreds or thousands of learners, these gaps create ongoing manual work. The SSO-as-add-on model means you're paying extra fees on top of already custom Enterprise pricing ($6-12/user/month base, but varies significantly). For learning management systems handling external partners, contractors, and employees across different access levels, the inability to update existing user attributes through SAML provisioning forces IT teams into manual account management—exactly what automated provisioning should eliminate.

View full guide
Airbase logo

Airbase

SCIM Tax

Spend Management / Corporate Cards

SCIM StatusIncluded
Manual Cost$11,754/yr

Airbase supports SCIM provisioning, but only on Enterprise plans starting around $8,500/year. While SCIM works with all major identity providers (Okta, Entra ID, Google Workspace), the Enterprise requirement creates a significant barrier for smaller finance teams who need automated provisioning for spend management but can't justify enterprise-level spend management software costs. This creates a particular challenge in finance applications where rapid provisioning and deprovisioning is critical for corporate card access and financial controls. Manual user management means delayed access for new employees needing corporate cards, and more critically, potential security gaps when departing employees retain access to spend management systems. For finance teams handling sensitive financial data and corporate spending, these delays and oversights create both operational friction and compliance risks.

View full guide