Lever SCIM guide

Workable, the applicant tracking system used by hiring teams, does not support SCIM provisioning on any plan. While Workable offers SAML 2.0 SSO integration starting with the Standard plan (plus add-on fees) or Premier plan, this only handles authentication—not user lifecycle management. Users granted access through SSO can join the Workable account automatically via JIT provisioning, but they still require manual job assignment and role configuration within the platform. This creates a significant gap for IT teams managing hiring workflows across multiple departments. Without SCIM, administrators must manually provision recruiters and hiring managers, assign them to appropriate job requisitions, and remember to deprovision access when employees change roles or leave. For an ATS platform that handles sensitive candidate data and hiring decisions, this manual process introduces compliance risks and operational overhead that scales poorly as organizations grow.

Greenhouse supports SCIM provisioning, but only on Advanced or Expert tiers (starting around $6,000/year, quote-based). The bigger issue: Greenhouse's SCIM implementation only provisions users—not groups—meaning you lose the organizational structure and permission inheritance that makes identity management scalable. Additionally, you cannot fully delete users via SCIM (only deactivate), and Azure Entra users face a 40-minute sync delay. For recruiting teams managing hiring managers, interviewers, and HR staff across different departments and access levels, the lack of group provisioning creates a significant operational burden. You're forced to manually assign permissions and manage access changes for every user individually. With recruiting involving sensitive candidate data and frequent access changes during hiring cycles, this manual overhead increases both security risk and administrative workload.

Builder.io, the visual CMS platform used by developers and content teams, does not offer SCIM provisioning on any plan. While Builder.io provides SAML 2.0 SSO integration on their Enterprise tier with identity providers like Okta, Azure AD, and Google Workspace, this only handles authentication—not the automated provisioning and deprovisioning of user accounts. IT teams must manually create and manage user accounts in Builder.io, then separately assign appropriate permissions for different Spaces and projects. This creates a significant operational gap for organizations using Builder.io across multiple content teams. Without SCIM, departing employees retain access to Builder.io Spaces until manually removed, creating security risks around content management systems that often contain sensitive marketing materials and website code. The manual overhead becomes particularly problematic when managing access across multiple Builder.io Spaces, each requiring individual permission management for developers, marketers, and content editors.