Summary and recommendation
Hive supports SCIM 2.0 provisioning with Okta, but only after purchasing the Enterprise Security Add-on on top of an Enterprise plan. This means teams on Starter ($5/user/month) or Teams ($12/user/month) plans must upgrade to custom Enterprise pricing plus pay for the Security Add-on—potentially increasing costs by 5-10x just to unlock automated user provisioning. Additionally, ADFS users get SSO but no auto-deprovisioning, creating a manual offboarding burden.
For project management platforms like Hive where team composition changes frequently, manual user management becomes a significant administrative burden. Teams launch new projects, contractors join temporarily, and employees shift between initiatives—all requiring manual account creation and cleanup. Without automated provisioning, IT teams spend hours managing Hive accounts that should be handled automatically through your identity provider.
The strategic alternative
Stitchflow provides SCIM-level provisioning through resilient browser automation for Hive without requiring the Enterprise tier upgrade or Security Add-on. Works with any Hive plan and any IdP (including full ADFS deprovisioning support). Flat pricing under $5K/year, regardless of team size.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Official docs |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ❌ | SSO only |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Hive accounts manually. Here's what that costs:
The Hive pricing problem
Hive gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Plan Structure
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Free | $0 (10 users) | ||
| Starter | $5/user/mo | ||
| Teams | $12/user/mo | ||
| Enterprise | Custom |
Note: SCIM requires the Enterprise Security Add-on and cannot be purchased standalone. SAML SSO must be configured before SCIM setup.
What this means in practice
The pricing jump from Teams to Enterprise represents a significant cost increase for organizations that need automated provisioning:
For teams currently on the $12/user Teams plan, the upgrade to Enterprise with Security Add-on typically represents a 3-4x cost increase based on similar SaaS pricing patterns.
Additional constraints
Summary of challenges
- Hive supports SCIM but only at Enterprise tier (custom pricing)
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Hive doesn't sell SCIM standalone. It's buried in the Enterprise Security Add-on, bundled with other enterprise features:
The Enterprise Security Add-on pricing isn't public, but it requires an Enterprise plan base (custom pricing) plus the security add-on fee. If you're on the Teams plan ($12/user/month), you can add security features, but SCIM specifically requires the full Enterprise upgrade.
For teams that just want automated user provisioning, you're paying enterprise prices for a security bundle where ~80% of features are administrative overhead. The real kicker: SCIM only works with Okta. If you're using Entra ID, Google Workspace, or OneLogin, you get JIT provisioning at best—no automated deprovisioning when employees leave.
What IT admins are saying
Community sentiment on Hive's SCIM limitations centers around restrictive requirements and partial IdP support. Common complaints:
- Being locked into the Enterprise Security Add-on just for basic SCIM provisioning
- ADFS users stuck with manual deprovisioning despite SSO support
- Having to set up SAML SSO first before SCIM can be configured
- Password management limitations requiring manual user setup steps
ADFS does not support auto-deprovisioning, so we have to manually remove users when they leave. Not ideal for a security feature we're paying extra for.
The recurring theme
Hive's SCIM feels like an afterthought - requiring expensive add-ons while leaving gaps in functionality that force IT teams back to manual processes.
The decision
| Your Situation | Recommendation |
|---|---|
| On Free/Starter/Teams, need SCIM | Use Stitchflow: avoid the Enterprise tier jump and add-on costs |
| Already on Enterprise with Security Add-on | Use native SCIM: you're paying for it with Okta |
| Using ADFS and need auto-deprovisioning | Use Stitchflow: ADFS doesn't support auto-deprovisioning natively |
| Using Entra/Google Workspace, need SCIM | Use Stitchflow: no native SCIM support for these IdPs |
| Small team with minimal user changes | Manual provisioning may work: but watch for security gaps |
The bottom line
Hive's SCIM requires both Enterprise tier and the Security Add-on, creating a significant cost barrier for smaller teams. For organizations that need automated provisioning without the Enterprise commitment—or those using non-Okta IdPs—Stitchflow delivers the same automation at predictable flat pricing.
Automate Hive without the tier upgrade
Stitchflow delivers SCIM-level provisioning through resilient browser automation, backed by 24/7 human in the loop for Hive at <$5K/year, flat, regardless of team size.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
SSO must be configured first
Key limitations
- Enterprise Security Add-on required
- ADFS does not support auto-deprovisioning
- Password sync not supported via SCIM
- Must set up SAML SSO before SCIM
- Set password when creating users should be unchecked
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
Full SCIM 2.0 integration in OIN. Supports Create Users, Update Attributes, Deactivate Users, and Group Push. Requires Enterprise Security Add-on. Email must be used as username format.
Native SCIM is available on Enterprise. Use Stitchflow if you need provisioning without the tier upgrade.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
SSO with JIT provisioning. User created on first authentication. Some users requesting deeper Azure AD/Entra integration. No SCIM provisioning via Entra documented.
Use Stitchflow for automated provisioning.
Unlock SCIM for
Hive
Hive gates automation behind Enterprise Security Add-on plan. Stitchflow delivers the same SCIM outcomes for a flat fee.
See how it works
