Google Workspace SCIM guide

AWS IAM Identity Center supports SCIM 2.0 provisioning and is completely free—no additional licensing costs beyond your AWS account. However, the implementation has significant operational limitations that create ongoing management overhead for IT teams. The core issues: SCIM sync runs every 20-40 minutes (not real-time), multivalue attributes aren't supported, and once SCIM is enabled, you lose the ability to manually manage users through the AWS console. More problematic, Azure AD users face nested group limitations and attribute removal sync issues, while all IdPs must work around the requirement for specific mandatory fields (First name, Last name, Username, Display name). For organizations managing complex AWS multi-account environments with varying permission sets, these constraints force manual workarounds that undermine automation benefits. While IAM Identity Center's free pricing is attractive, the operational friction from sync delays, attribute limitations, and console lockout creates hidden administrative costs—especially when managing hundreds of users across multiple AWS accounts with different access requirements.

Atlassian Jira Service Management supports SCIM 2.0 for provisioning both support agents and customers, but only with an Atlassian Guard Standard subscription on top of your existing JSM plan. This means paying for two separate subscriptions: JSM ($20-57/agent/month) plus Guard for SCIM functionality. For enterprise teams with 201+ agents, this often results in six-figure annual costs just to enable automated provisioning. The dual subscription model creates significant budget friction for IT teams who need basic user lifecycle management. Without SCIM, you're manually managing agent accounts and customer portal access, creating security gaps when employees change roles or leave. JSM's customer provisioning complexity—requiring specific product access roles and organization mapping—makes manual management even more error-prone for large service desk operations.

15Five includes SCIM provisioning on all plans starting at $4/user/month, with full support for creating, updating, and deactivating users across Okta, Entra ID, Google Workspace, and OneLogin. However, 15Five's SCIM implementation has a critical prerequisite: SSO must be configured first, and their documentation explicitly warns against using JIT provisioning alongside SCIM due to duplicate user creation risks. This creates operational friction for IT teams managing performance management rollouts. The SSO-first requirement means you can't test SCIM provisioning in isolation, and the JIT conflict forces you to choose between automated onboarding convenience and reliable user lifecycle management. For HR-driven tools like 15Five that need to maintain accurate manager hierarchies and team structures, these provisioning gaps can disrupt performance review cycles and employee engagement tracking.