Stitchflow
Launch Darkly logo

Launch Darkly SCIM guide

Native SCIM

How to automate Launch Darkly user provisioning, and what it actually costs

Native SCIM requires Enterprise plan

Summary and recommendation

LaunchDarkly supports native SCIM provisioning, but only on Enterprise plans with custom pricing. This creates a significant barrier for smaller development teams who need automated user management but can't justify Enterprise costs. Additionally, LaunchDarkly's SCIM implementation has a critical limitation: team sync (automated group membership management) only works with Okta. Teams using Entra ID, Google Workspace, or OneLogin get basic user provisioning but must manually manage team assignments and permissions.

For development teams managing feature flags across multiple environments, this limitation creates serious operational overhead. Feature flag access often needs to align with development teams, project assignments, and environment permissions. Without automated team sync, IT admins must manually maintain these mappings as developers join, leave, or change projects. This manual process increases security risk and slows developer onboarding.

The strategic alternative

Launch Darkly gates SCIM behind Enterprise. Skip the Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredEnterprise
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDGallery app with SCIM
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Launch Darkly accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Launch Darkly pricing problem

Launch Darkly gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Plan Structure

PlanPriceSSOSCIM
DeveloperFree
Foundation$10-12/service connection/month
EnterpriseCustom pricing

Note: Foundation pricing is $10/month annually or $12/month billed monthly per service connection. Enterprise pricing is quote-based and typically represents a significant jump from Foundation tier costs.

What this means in practice

The leap from Foundation to Enterprise creates unpredictable budget impact:

Foundation tier costs (per service connection):

Annual
$120/connection/year
Monthly
$144/connection/year

Enterprise upgrade: Custom pricing means teams can't accurately budget for SCIM access until they engage in a sales process. Industry estimates suggest Enterprise pricing often runs 3-5x Foundation costs, potentially reaching thousands of dollars annually even for small teams.

Real-world scenario: A development team with 3 service connections on Foundation ($360/year annual) faces an unknown but likely substantial cost increase to access basic SCIM provisioning.

Additional constraints

SSO prerequisite
SCIM requires SAML SSO to be configured first, adding implementation complexity.
Okta-only team sync
While SCIM works with multiple IdPs (Okta, Azure AD, Google Workspace), team synchronization is exclusively available with Okta, creating vendor lock-in.
Single IdP limitation
Only one identity provider can be linked at a time, blocking multi-IdP enterprise scenarios.
SAML/SCIM conflicts
Cannot use both SAML and SCIM for team assignment simultaneously—SCIM overrides SAML team mapping.

Summary of challenges

  • Launch Darkly supports SCIM but only at Enterprise tier (custom pricing)
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

LaunchDarkly doesn't sell SCIM separately. It's locked to Enterprise pricing with feature management controls:

SCIM automated provisioning (Enterprise only)
SAML single sign-on (SSO)
Advanced role-based access controls
Team sync with Okta (not other IdPs)
Advanced security and compliance features
Custom roles and permissions
Priority support and SLA guarantees
Advanced audit logging

The catch: you need SSO configured first, and team sync only works with Okta. If you use Entra, Google Workspace, or OneLogin, you get basic SCIM provisioning but lose the streamlined team management capabilities.

Stitchflow Insight

If you need enterprise-grade feature flag governance anyway, the upgrade makes sense. If you just want automated user provisioning across multiple IdPs, you're paying enterprise rates for a partially functional solution. We estimate ~60% of Enterprise features are overkill for teams that simply need reliable SCIM provisioning with any identity provider.

What IT admins are saying

Community sentiment on LaunchDarkly's SCIM limitations centers around IdP restrictions and Enterprise pricing requirements. Common complaints:

  • Team sync functionality locked exclusively to Okta, leaving other IdPs with basic provisioning only
  • SCIM requiring Enterprise plan upgrade with custom pricing
  • Cannot mix SAML team assignment with SCIM (SCIM overrides all SAML-based team mappings)
  • Single IdP limitation preventing multi-vendor identity strategies

Team sync only works with Okta - if you're using Azure AD or Google Workspace, you're stuck with manual team management despite having SCIM.

Reddit r/devops

The Enterprise pricing gate for SCIM is frustrating when you just need basic automated provisioning for your development teams.

LaunchDarkly Community Forum

The recurring theme

LaunchDarkly's SCIM implementation creates a two-tier experience where Okta customers get full functionality while other IdP users face significant limitations, all behind an Enterprise paywall.

The decision

Your SituationRecommendation
On Foundation/Professional, need SCIMUse Stitchflow: avoid the Enterprise upgrade cost
On Enterprise but only using Okta for team syncUse Stitchflow: get proper multi-IdP support
Already on Enterprise with full SCIM needsUse native SCIM: you're paying Enterprise pricing anyway
Need Enterprise features beyond SCIMEvaluate Enterprise: SCIM comes bundled with other advanced features
Small dev team, infrequent access changesManual may work: but watch for security gaps in feature flag access

The bottom line

Launch Darkly gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Make Launch Darkly workflows AI-native

Launch Darkly gates SCIM behind Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.

No Enterprise upgrade required
Less than a week, start to finish (~2 hours of your time)
We maintain the integration layer underneath
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Enterprise

Prerequisites

SSO must be configured first

Key limitations

  • SCIM only on Enterprise plan
  • Team sync only available with Okta (not other IdPs)
  • Only one IdP can be linked at a time
  • Cannot mix SAML and SCIM team assignment (SCIM overrides SAML)

Configuration for Okta

Integration type

Okta Integration Network (OIN) app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Okta Admin Console → Applications → Launch Darkly → Provisioning

Required credentials

SCIM endpoint URL and bearer token (generated in app admin console).

Configuration steps

Enable Create Users, Update User Attributes, and Deactivate Users.

Provisioning trigger

Okta provisions based on app assignments (users or groups).

Full SCIM provisioning with Okta. Team sync only available with Okta. Can manage LaunchDarkly Custom Roles from within Okta. Email addresses must be lowercase.

Launch Darkly gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Launch Darkly → Provisioning

Required credentials

Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).

Configuration steps

Set Provisioning Mode = Automatic, configure SCIM connection.

Provisioning trigger

Entra provisions based on user/group assignments to the enterprise app.

Sync behavior

Entra provisioning runs on a scheduled cycle (typically every 40 minutes).

SCIM provisioning requires separate custom enterprise app (not the gallery SAML app). Contact LaunchDarkly Support for OAuth2 client ID and secret. SCIM endpoint: https://app.launchdarkly.com/trust/scim/v2

Launch Darkly gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Unlock SCIM for
Launch Darkly

Launch Darkly gates SCIM behind Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.

See how it works
Admin Console
Directory
Applications
Launch Darkly logo
Launch Darkly
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

Amplitude logo

Amplitude

SCIM Tax

Product Analytics

SCIM StatusIncluded
Manual Cost$11,754/yr

Amplitude supports SCIM provisioning, but only on Growth plans (starting around $36K/year) or Enterprise plans with custom pricing. While Amplitude's SCIM implementation covers the core functionality—creating, updating, and deactivating users—it requires SCIM to be specifically enabled for your organization, and regenerating the SCIM key immediately invalidates existing integrations without warning. For product teams on Plus plans ($49/month), upgrading to Growth just to unlock SCIM means jumping from under $600/year to $36,000+/year—a 60x increase. That's often more than the entire analytics budget for smaller product teams. The gap becomes particularly problematic for cross-functional product teams where analysts, PMs, and engineers need varying levels of access to user behavior data, but manual provisioning creates security risks around sensitive analytics permissions.

View full guide
Bugsnag logo

Bugsnag

SCIM Tax

Error Monitoring / Observability

SCIM StatusIncluded
Manual Cost$11,754/yr

Bugsnag supports native SCIM provisioning, but only on Enterprise plans with custom pricing. This creates a significant cost barrier since you must upgrade from Business ($475/month for 1M events) to Enterprise just to unlock automated user provisioning. For many engineering teams, this represents a substantial price jump for provisioning features that should be standard across all paid plans. The Enterprise requirement is particularly problematic for mid-size development teams who need error monitoring automation but don't require Enterprise-level features. Without SCIM, IT teams must manually provision developer accounts and manage team memberships for project access—creating security gaps when developers change teams or leave the company. OneLogin users face an additional limitation: SCIM isn't supported on Enterprise instances, forcing a workaround through the standard Bugsnag app.

View full guide
Greenhouse logo

Greenhouse

SCIM Tax

HR / Recruiting

SCIM StatusIncluded
Manual Cost$11,754/yr

Greenhouse supports SCIM provisioning, but only on Advanced or Expert tiers (starting around $6,000/year, quote-based). The bigger issue: Greenhouse's SCIM implementation only provisions users—not groups—meaning you lose the organizational structure and permission inheritance that makes identity management scalable. Additionally, you cannot fully delete users via SCIM (only deactivate), and Azure Entra users face a 40-minute sync delay. For recruiting teams managing hiring managers, interviewers, and HR staff across different departments and access levels, the lack of group provisioning creates a significant operational burden. You're forced to manually assign permissions and manage access changes for every user individually. With recruiting involving sensitive candidate data and frequent access changes during hiring cycles, this manual overhead increases both security risk and administrative workload.

View full guide