Stitchflow
Freshchat logo

Freshchat SCIM guide

Connector Only

How to automate Freshchat user provisioning, and what it actually costs

Summary and recommendation

Freshchat offers SCIM provisioning only on Enterprise plans ($95/agent/month), but only through specific marketplace apps for OneLogin and Azure AD - not as native SCIM functionality. This creates a significant limitation for organizations using other identity providers like Okta or Google Workspace, who must rely on workarounds or manual provisioning. Even with supported IdPs, the implementation requires installing separate Freshworks marketplace apps rather than standard SCIM connectors, adding complexity to your identity management stack.

The restricted SCIM support creates operational friction for IT teams managing Freshchat access across support, sales, and customer success teams. Without proper provisioning automation, organizations face the dual burden of manual user lifecycle management and the security risk of orphaned accounts when agents leave or change roles. For growing support teams that need rapid onboarding and consistent access controls, the Enterprise-only requirement represents a substantial cost barrier - potentially adding tens of thousands annually just to access basic provisioning capabilities.

The strategic alternative

Freshchat has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?No
SCIM tier requiredN/A
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0, OAuth2, OIDC, JWT
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaVia third-partyUse unified Freshworks Okta integration. Legacy Freshchat SSO app deprecated. Install Freshworks app for SSO/SCIM config.
Microsoft Entra IDVia third-partyAzure AD Provisioning (SCIM) available via Freshworks Marketplace. Part of unified Freshworks identity.
Google WorkspaceVia third-partyNo native support
OneLoginVia third-partyNo native support

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Freshchat accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Freshchat pricing problem

Freshchat gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
Growth$19-23/agent/month
Pro$49-59/agent/month
Enterprise$95/agent/month

Pricing structure

PlanPriceSSOSCIM
Growth$19-23/agent/month
Pro$49-59/agent/month
Enterprise$95/agent/month

What this means in practice

For a 20-person support team currently on Pro ($59/agent/month), upgrading to Enterprise solely for SCIM costs an additional $43,200/year:

Pro plan
$1,180/month × 12 = $14,160/year
Enterprise plan
$1,900/month × 12 = $22,800/year
Upgrade cost
$8,640/year just for provisioning

This 61% price increase forces teams to choose between automated user management and budget constraints, especially problematic for growing support operations that need efficient onboarding.

Additional constraints

Limited SCIM implementation
Only available through OneLogin or Azure AD marketplace apps, not direct SCIM endpoints
Freshworks suite dependency
Must use the unified Freshworks identity system rather than app-specific provisioning
Legacy app deprecation
Previous Freshchat-specific SSO integrations were deprecated, forcing migration to the broader Freshworks platform
No middle ground
No Pro+ or Business tier that includes basic provisioning without full enterprise features

Summary of challenges

  • Freshchat does not provide native SCIM at any price tier
  • Organizations must rely on third-party tools or manual provisioning
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

Enterprise Plan ($95/agent/month)

Freshchat's Enterprise tier includes identity management as part of the broader Freshworks suite integration:

Identity & Access Features:

SAML 2.0, OAuth2, and OIDC SSO protocols
SCIM provisioning via OneLogin or Azure AD marketplace apps
Just-in-time (JIT) user provisioning
Integration with unified Freshworks identity system
Multi-protocol SSO support (SP and IdP initiated)

Enterprise Business Features:

Advanced chatbot and workflow automation
Custom roles and advanced security controls
API access and webhooks
Advanced reporting and analytics
Priority support and account management
Integration marketplace access

The Reality Check

What you're paying for: The $95/agent/month Enterprise plan is designed for large support organizations that need the full Freshworks ecosystem. You're paying for advanced customer service automation, not just identity management.

The SCIM limitation: Freshchat doesn't offer native SCIM. Instead, you're dependent on third-party marketplace apps from OneLogin or Azure AD to handle provisioning. This creates an additional integration layer and potential failure point.

Cost impact for identity-focused teams: If you have 50 support agents and only need SCIM provisioning, you're paying $4,750/month ($57K annually) primarily for business features you may not use, with SCIM as a secondary capability through external apps.

What IT admins are saying

Freshchat's SCIM limitations through OneLogin and Azure only create deployment headaches for IT teams:

  • Enterprise pricing wall - SCIM requires $95/agent/month Enterprise plan, making automation expensive for smaller support teams
  • Limited IdP options - SCIM only works through OneLogin or Azure AD provisioning apps, excluding Okta and Google Workspace admins
  • Freshworks app confusion - Legacy Freshservice SSO app deprecated, must use unified Freshworks app for post-2020 configurations
  • Manual workarounds - Teams on Pro plans ($49-59/agent) stuck with manual user management despite having SSO

SCIM via OneLogin or Azure provisioning apps

Freshworks documentation, highlighting the restrictive integration approach

Install Freshworks app for SSO config (post March 2020)

Freshworks support, acknowledging the migration complexity from legacy apps

The recurring theme

Freshchat's SCIM approach forces IT teams into specific IdP workflows and expensive Enterprise pricing, leaving many organizations managing support agents manually despite having modern identity infrastructure.

The decision

Your SituationRecommendation
Small support team (<10 agents)Manual management is acceptable on Growth plan
Mixed Freshworks suite deploymentNative SCIM via OneLogin/Azure if already on Enterprise
Pure Freshchat with <25 agentsUse Stitchflow: avoid $95/agent Enterprise upgrade
Large customer success organizationUse Stitchflow: automation essential for team management
Multi-product stack beyond FreshworksUse Stitchflow: unified provisioning across all apps

The bottom line

Freshchat's SCIM requires the $95/agent Enterprise plan and only works through OneLogin or Azure marketplace apps. For organizations that don't need Enterprise features or use other identity providers, Stitchflow delivers full provisioning automation at a fraction of the cost.

Make Freshchat workflows AI-native

Freshchat has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.

Covers apps without native SCIM, including the ones without APIs
Less than a week, start to finish (~2 hours of your time)
Built with your team; extend to anything else in the company
Book a Demo

Technical specifications

SCIM Version

Not specified

Supported Operations

Not specified

Supported Attributes

Not specified

Plan requirement

Not specified

Prerequisites

Not specified

Key limitations

  • Legacy Freshservice SSO app deprecated
  • Install Freshworks app for SSO config (post March 2020)
  • SCIM via OneLogin or Azure provisioning apps

Configuration for Okta

Integration type

Okta Integration Network (OIN) app

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Okta Admin Console → Applications → Freshchat → Sign On

Use unified Freshworks Okta integration. Legacy Freshchat SSO app deprecated. Install Freshworks app for SSO/SCIM config.

Use Stitchflow for automated provisioning.

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Freshchat → Single sign-on

Azure AD Provisioning (SCIM) available via Freshworks Marketplace. Part of unified Freshworks identity.

Use Stitchflow for automated provisioning.

Unlock SCIM for
Freshchat

Freshchat has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.

See how it works
Admin Console
Directory
Applications
Freshchat logo
Freshchat
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

6sense logo

6sense

No SCIM

B2B Revenue Intelligence / ABM

ProvisioningNot Supported
Manual Cost$11,754/yr

6sense, the B2B revenue intelligence platform, has paused SCIM provisioning for new customers until Q4 2026. While existing customers with SCIM enabled can continue using it, new implementations are limited to JIT (Just-In-Time) provisioning through SAML SSO. This creates a significant gap for IT teams managing revenue intelligence access, as JIT only creates users on first login and provides minimal attribute mapping (email, first name, last name only). For an enterprise platform with typical pricing of $55,000-$130,000 annually, the absence of automated user lifecycle management is a substantial limitation. The lack of SCIM until Q4 2026 forces IT teams into manual provisioning workflows for a platform handling sensitive revenue data. While SAML SSO handles authentication, it doesn't address user lifecycle events like role changes, department transfers, or offboarding. This creates compliance risks in revenue teams where access to prospect data and sales intelligence must be tightly controlled. The nearly two-year wait for SCIM restoration means organizations implementing 6sense today face manual user management for the foreseeable future.

View full guide
Aha! logo

Aha!

No SCIM

Product Management / Roadmapping

ProvisioningNot Supported
Manual Cost$11,754/yr

Aha! Roadmaps, the product roadmapping platform, does not support SCIM provisioning on any plan. While Aha! offers SAML 2.0 SSO integration with identity providers like Okta, Entra ID, and OneLogin, this only handles authentication through JIT (Just-In-Time) provisioning. The critical limitation: JIT provisioning creates user accounts with no default role or access permissions, requiring administrators to manually configure access for each user after they first sign in. For product teams managing strategic roadmaps and stakeholder access, this creates significant operational overhead. Since product roadmaps contain sensitive strategic information and stakeholder access typically varies by product area, IT administrators must manually assign appropriate roles and workspace permissions after each user is provisioned. There's no automatic deprovisioning when users leave the organization, creating potential security gaps. This manual process becomes particularly problematic for larger product organizations where dozens of stakeholders across different business units need carefully managed access to specific roadmaps.

View full guide
Appcues logo

Appcues

No SCIM

Product Adoption / User Onboarding

ProvisioningNot Supported
Manual Cost$11,754/yr

Appcues, the product adoption platform used by product managers and growth teams, explicitly does not support SCIM provisioning on any plan—not even Enterprise. While Appcues offers SAML 2.0 SSO integration starting at the Enterprise tier with just-in-time (JIT) provisioning, this only creates users during first login and provides no automated deprovisioning capabilities. For product teams where access needs change frequently as people move between projects or leave the company, this creates a significant security gap. The lack of SCIM means IT teams must manually manage user lifecycle for Appcues accounts, even though the platform handles sensitive product analytics and user flow data. When employees leave or change roles, their Appcues access remains active until manually revoked—a compliance risk that's particularly problematic given Appcues' role in tracking user behavior and product metrics. With MAU-based pricing starting at $300/month and scaling significantly with usage, paying for orphaned accounts also creates unnecessary cost bloat.

View full guide