Jenkins SCIM guide

Buildkite supports SCIM provisioning through Okta and Azure AD connectors, but only on Enterprise plans with custom pricing. While Business plans ($25/user/month) include SAML SSO, they lack SCIM deprovisioning—meaning users remain active in Buildkite even after being removed from your IdP. Additionally, custom SAML providers require contacting support for a feature flag to enable SCIM functionality, creating deployment delays and support dependencies. This creates a significant security gap for engineering organizations. DevOps teams frequently change, contractors come and go, and engineers move between projects requiring different pipeline access. Without automated deprovisioning, former team members retain access to build agents, deployment pipelines, and potentially production infrastructure. JIT provisioning delays billing until first login, but manual offboarding creates compliance risks that outweigh any cost savings.

CircleCI, the popular CI/CD platform, does not offer native SCIM provisioning capabilities. While CircleCI supports SAML 2.0 SSO on their Scale plan ($300+/month), automated user provisioning is only available through Okta's CircleCI connector using SCIM 2.0. This creates a significant limitation: organizations using Azure Entra ID, Google Workspace, or OneLogin as their primary identity provider cannot automate CircleCI user lifecycle management, forcing IT teams to manually provision and deprovision developer accounts in a platform that handles sensitive source code and build secrets. The lack of universal SCIM support creates a compliance and security risk for DevOps teams. Manual provisioning means delayed access for new developers joining projects, and more critically, potential delays in deprovisioning when team members leave—leaving former employees with access to CI/CD pipelines, source code repositories, and build secrets. For organizations not using Okta, the choice becomes accepting manual user management overhead or switching identity providers solely to enable CircleCI automation.

Builder.io, the visual CMS platform used by developers and content teams, does not offer SCIM provisioning on any plan. While Builder.io provides SAML 2.0 SSO integration on their Enterprise tier with identity providers like Okta, Azure AD, and Google Workspace, this only handles authentication—not the automated provisioning and deprovisioning of user accounts. IT teams must manually create and manage user accounts in Builder.io, then separately assign appropriate permissions for different Spaces and projects. This creates a significant operational gap for organizations using Builder.io across multiple content teams. Without SCIM, departing employees retain access to Builder.io Spaces until manually removed, creating security risks around content management systems that often contain sensitive marketing materials and website code. The manual overhead becomes particularly problematic when managing access across multiple Builder.io Spaces, each requiring individual permission management for developers, marketers, and content editors.