Summary and recommendation
Meta Ads supports SCIM 2.0 provisioning through Meta Work Accounts, which is free to access. However, Meta Work Accounts is currently only available to "select customers" - meaning most organizations can't access this functionality despite it being technically free. Even when available, SCIM only works with managed Meta Work Accounts, not personal Facebook profiles, creating a complex dual-account management scenario for many teams.
This selective availability creates a significant operational gap. Without automated provisioning, IT teams must manually manage Meta Ads access for marketing teams, often dealing with personal Facebook accounts that can't be centrally controlled. When employees leave, their personal accounts retain access to company ad accounts and sensitive campaign data, creating compliance and security risks that SSO alone can't address.
The strategic alternative
Meta Ads has native SCIM. Provisioning is only one part of the job. Offboarding, access reviews, and license cleanup still break across the rest of the stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Free |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ✓ | Gallery app with SCIM |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Meta Ads accounts manually. Here's what that costs:
The Meta Ads pricing problem
Meta Ads gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Free Access | $0 | ||
| Meta Work Accounts | Free* |
Plan Structure
| Plan | Price | SCIM |
|---|---|---|
| Free Access | $0 | ❌ |
| Meta Work Accounts | Free* | ✓ |
*Invitation-only program with undisclosed qualification criteria
What this means in practice
The core issue isn't pricing—it's access. Meta Work Accounts represents a fundamental shift from personal Facebook profiles to managed corporate accounts, but Meta hasn't opened this broadly:
Current state: Most organizations use personal Facebook profiles for Meta Ads access, which cannot integrate with SSO or SCIM systems.
Required state: Meta Work Accounts creates managed identities that can be provisioned via SCIM, but qualification criteria and rollout timeline remain unclear.
Practical impact: IT teams cannot reliably plan for SCIM implementation since they don't control when (or if) their organization will qualify for Meta Work Accounts access.
Additional constraints
Summary of challenges
- Meta Ads supports SCIM but only at Free tier (N/A (pay-per-click/impression model))
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Meta Ads actually offers for identity
Meta Ads supports SCIM provisioning, but only through Meta Work Accounts - a managed account system that's currently available to select customers only. This creates a significant barrier for most organizations.
Here's what Meta Work Accounts includes:
The catch: Meta Work Accounts requires users to abandon their personal Facebook profiles for advertising activities. Your team gets managed corporate accounts that are completely separate from personal Facebook access. This creates workflow friction since most marketers are accustomed to using their personal profiles.
Additionally, Meta Work Accounts is still in limited availability - you can't simply sign up. Meta controls who gets access to this managed account system, making it unavailable to most organizations that need SCIM provisioning today.
For teams that just want automated user lifecycle management without overhauling their entire Facebook workflow, the Work Accounts requirement is overkill and disruptive.
What IT admins are saying
Community sentiment on Meta Ads SCIM is mixed, with frustration centered on the Meta Work Accounts requirement. Common complaints:
- Meta Work Accounts is only available to "select customers" - unclear eligibility criteria
- Forced to use managed accounts instead of personal Facebook profiles
- Limited transparency on when Meta Work Accounts access will be broadly available
- Additional administrative overhead managing separate work account system
We've been waiting months for Meta Work Accounts access just to get basic SCIM working. No clear timeline from Meta on when it'll be generally available.
The whole Meta Work Accounts setup feels like an afterthought. Why can't we just provision to regular business accounts?
The recurring theme
Meta's SCIM implementation is technically solid but gated behind a limited-availability program, leaving many organizations unable to automate their Meta Ads user management despite having the business need.
The decision
| Your Situation | Recommendation |
|---|---|
| Need SCIM but not eligible for Meta Work Accounts | Use Stitchflow: access SCIM-level provisioning without the managed account requirement |
| Personal Facebook profiles in your organization | Use Stitchflow: works with existing personal accounts, no Work Accounts migration needed |
| Want SCIM without the Meta Work Accounts complexity | Use Stitchflow: simpler setup, no dependency on Meta's selective availability program |
| Approved for Meta Work Accounts, comfortable with managed setup | Use native SCIM: you have access to the official integration |
| Small ad team with minimal user changes | Manual may work: but monitor for access gaps when employees leave |
The bottom line
Meta Ads has native SCIM, but the workflow still spans more than one system. Provisioning is only one part of the job.
Close the Meta Ads workflow gap
Meta Ads has native SCIM, but the workflow still spans more than one system. Stitchflow builds and maintains the full workflow across the rest of your stack.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Free
Prerequisites
None
Key limitations
- Requires Meta Work Accounts (managed accounts)
- Meta Work Accounts feature currently available to select customers only
- Personal Facebook profiles cannot use SSO/SCIM
- SCIM tenant URL: https://scim.workplace.com/
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
Docs
Via Meta Work Accounts integration. Supports SSO (SAML), SCIM, entitlements, universal logout, workflows, and ISPM.
Meta Ads has native SCIM, but the workflow still spans more than one system. Provisioning is only one part of the job.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app with SCIM provisioning
Where to enable
Required credentials
Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).
Configuration steps
Set Provisioning Mode = Automatic, configure SCIM connection.
Provisioning trigger
Entra provisions based on user/group assignments to the enterprise app.
Sync behavior
Entra provisioning runs on a scheduled cycle (typically every 40 minutes).
Full SCIM provisioning via Meta Work Accounts. Automatically provisions and de-provisions users and groups.
Meta Ads has native SCIM, but the workflow still spans more than one system. Provisioning is only one part of the job.
Close the workflow gap in
Meta Ads
Meta Ads has native SCIM, but the workflow still spans more than one system. Provisioning is only one part of the job.
Start with the free gap diagnostic
