Summary and recommendation
Google Cloud Platform supports SCIM provisioning through Cloud Identity Premium at $7.20/user/month, but this creates a fundamental architectural challenge for IT teams. While Cloud Identity can sync users and groups from your IdP (Okta, Entra ID, etc.), it only handles identity provisioning—not the critical step of mapping users to specific GCP projects and IAM roles. This means IT admins face a two-step manual process: first provisioning identities through SCIM, then separately assigning project access and role permissions through GCP's IAM system.
This separation between identity provisioning and access management creates significant operational overhead and security gaps. New developers might be provisioned as users but lack access to the projects they need to work on. Departing employees could have their Cloud Identity deactivated while retaining specific IAM permissions in individual projects. For enterprises managing hundreds of developers across multiple GCP projects, this dual-system approach makes compliance auditing complex and increases the risk of privilege creep.
The strategic alternative
Google Cloud gates SCIM behind Cloud Identity Premium. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across the rest of your stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Pro |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0, OIDC |
| Documentation | Official docs |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ✓ | Gallery app with SCIM |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Google Cloud accounts manually. Here's what that costs:
The Google Cloud pricing problem
Google Cloud gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Cloud Identity Free | $0 (50 users default) | ||
| Cloud Identity Premium | $7.20/user/month |
Pricing structure
| Plan | Price | SCIM |
|---|---|---|
| Cloud Identity Free | $0 (50 users default) | ❌ Not available |
| Cloud Identity Premium | $7.20/user/month | ✓ Available |
What this means in practice
For a 100-person team wanting SCIM provisioning to Google Cloud:
This creates a forced upsell scenario where Google Cloud SCIM requires purchasing their competing identity platform. You're essentially paying Google $7.20/user/month to compete with your existing IdP investment.
Additional constraints
The fundamental issue is architectural: Google designed GCP provisioning to drive adoption of their Cloud Identity platform, not to integrate cleanly with existing enterprise identity infrastructure.
Summary of challenges
- Google Cloud supports SCIM but only at Pro tier (custom pricing)
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Cloud Identity Premium ($7.20/user/month)
Google Cloud requires Cloud Identity Premium to enable SCIM provisioning:
| Feature | Included |
|---|---|
| SCIM provisioning | ✓ Yes |
| SSO for thousands of apps | ✓ Yes |
| Directory Sync | ✓ Yes |
| Secure LDAP | ✓ Yes |
| HR system sync | ✓ Yes |
| Advanced security controls | ✓ Yes |
| Premium support | ✓ Yes |
SCIM capabilities:
The enterprise bloat problem
Cloud Identity Premium bundles SCIM with numerous enterprise features that most teams don't need:
Key limitation: IAM permissions and project access are managed separately from Cloud Identity provisioning. SCIM only handles user/group sync - you still need to manually configure GCP IAM roles and project permissions.
For teams that simply want automated user provisioning to Google Cloud, you're paying $7.20/user/month for enterprise features you don't need, while still handling IAM role assignments manually.
What IT admins are saying
Google Cloud's SCIM provisioning creates cost barriers and complexity for IT teams:
- Premium pricing wall - SCIM requires Cloud Identity Premium at $7.20/user/month, adding significant cost just for basic provisioning
- Dual management overhead - Identity sync through Cloud Identity is separate from GCP IAM role assignments, requiring parallel management
- Enterprise-only features - Advanced provisioning capabilities locked behind premium tiers, excluding smaller organizations
- Complex architecture - Multi-layered setup with Cloud Identity as intermediary adds troubleshooting complexity
Cloud Identity Premium includes: SSO for thousands of apps, Directory Sync, secure LDAP, HR system sync.
Can be source or destination for SCIM... IAM permissions separate from identity
The recurring theme
Google forces IT teams to pay premium pricing for basic SCIM functionality, then still requires separate management of GCP IAM roles, creating both cost burden and operational overhead that many organizations struggle to justify.
The decision
| Your Situation | Recommendation |
|---|---|
| Small DevOps team (<20 users) on GCP Free | Manual management acceptable for now |
| Medium organization (20-100 users) | Upgrade to Cloud Identity Premium for native SCIM |
| Enterprise with complex GCP project structure | Use Stitchflow: separates identity sync from IAM complexity |
| Multi-cloud setup (GCP + AWS/Azure) | Use Stitchflow: unified provisioning across platforms |
| Cost-sensitive with stable workforce | Native SCIM if you can justify $7.20/user/month premium |
The bottom line
Google Cloud gates SCIM behind Cloud Identity Premium. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the Google Cloud workflow gap
Google Cloud gates SCIM behind Cloud Identity Premium, but the bigger issue is the workflow around it. Stitchflow builds and maintains the offboarding, access review, or license workflow underneath.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Pro
Prerequisites
SSO must be configured first
Key limitations
- Cloud Identity Premium required for SCIM
- Can be source or destination for SCIM
- IAM permissions separate from identity
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
Okta can provision users to Google Cloud Identity via SCIM. Cloud Identity acts as the IdP layer for GCP. Directory Sync extends on-premises directory to cloud.
Google Cloud gates SCIM behind Cloud Identity Premium. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).
Configuration steps
Set Provisioning Mode = Automatic, configure SCIM connection.
Provisioning trigger
Entra provisions based on user/group assignments to the enterprise app.
Sync behavior
Entra provisioning runs on a scheduled cycle (typically every 40 minutes).
Entra ID can provision users to Google Cloud Identity. Google can be source or destination for SCIM. IAM role permissions managed separately from identity provisioning.
Google Cloud gates SCIM behind Cloud Identity Premium. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the workflow gap in
Google Cloud
Google Cloud gates SCIM behind Cloud Identity Premium plan. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across your stack.
Start with the free gap diagnostic


