Stitchflow
Metabase logo

Metabase SCIM guide

Native SCIM

How to automate Metabase user provisioning, and what it actually costs

Native SCIM requires Pro/Enterprise plan

Summary and recommendation

Metabase supports SCIM 2.0 for automated user provisioning, but only on Pro ($500/month for 10 users) or Enterprise ($15,000/year minimum) plans. While Okta integration includes full user and group provisioning, Microsoft Entra ID SCIM is limited to users only—no group sync capability. For teams on Starter plans ($5/user/month), upgrading to Pro means jumping to $500/month base cost plus $10 per additional user, a significant expense increase just to unlock provisioning automation.

The Entra ID limitation creates a particular operational gap for data teams. Without group provisioning, IT admins must manually manage dashboard permissions and data access controls in Metabase, defeating much of the automation benefit. This becomes especially problematic as organizations scale their BI initiatives across departments, where group-based access control is essential for maintaining data governance and compliance.

The strategic alternative

Metabase gates SCIM behind Pro/Enterprise. Skip the Pro/Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredPro
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDGallery app with SCIM
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Metabase accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Metabase pricing problem

Metabase gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
Open SourceFree (self-hosted)
Starter$5/user/mo (cloud only)
Pro$500/mo (10 users) + $10/user
Enterprise$15,000/year minimum

Plan Structure

PlanPriceSCIM
Open SourceFree (self-hosted)
Starter$5/user/mo (cloud only)
Pro$500/mo (10 users) + $10/user
Enterprise$15,000/year minimum

Note: Pro plan includes 10 users for $500/month, with additional users at $10/month each. Annual Pro pricing is $5,400/year plus $108/user annually.

What this means in practice

For teams currently on Starter ($5/user/month), the jump to Pro represents a dramatic cost increase:

Team SizeCurrent Starter CostPro Plan CostAnnual Increase
10 users$600/year$6,000/year+$5,400
15 users$900/year$6,600/year+$5,700
25 users$1,500/year$7,800/year+$6,300

The Pro plan effectively sets a $6,000/year minimum for SCIM access, regardless of team size.

Additional constraints

Platform restriction
Starter plan is cloud-only, while Pro supports both cloud and self-hosted deployments.
Azure AD limitation
Microsoft Entra ID SCIM integration only supports user provisioning—no group synchronization, limiting role-based access management.
Manual token management
SCIM authentication relies on bearer tokens generated within Metabase settings, requiring admin access to configure.
SSO prerequisite
SAML SSO setup is typically required before implementing SCIM, adding configuration complexity.

Summary of challenges

  • Metabase supports SCIM but only at Pro tier (custom pricing)
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

Metabase doesn't sell SCIM separately. On Pro ($500/month) and Enterprise ($15,000/year), you get:

SCIM automated provisioning (Okta: users + groups, Azure AD: users only)
SAML single sign-on (SSO) with JIT provisioning
Advanced permission controls and row-level security
Audit logging and activity monitoring
White-label embedding capabilities
Premium data connectors
Priority support channels
Advanced caching and performance optimization

Stitchflow Insight

The Pro plan targets teams needing governance controls for BI data access. If you're already managing sensitive data or need embedding features, the upgrade makes business sense. But if you only want basic user provisioning, you're paying $500/month for features most teams won't touch. We estimate ~60% of Pro features are irrelevant for organizations that just need automated user management.

What IT admins are saying

Community sentiment on Metabase's SCIM implementation is mixed, with specific concerns around Azure AD limitations and pricing barriers for smaller teams.

  • Azure AD SCIM only supports user provisioning, not group sync
  • Pro plan requirement ($500/month minimum) locks out smaller BI teams
  • Annual Pro commitment ($5,400/year) feels steep for basic provisioning
  • Having to choose between Okta (full SCIM) vs Azure AD (partial SCIM)

The fact that Azure AD SCIM is users only while Okta gets full group support feels like we're being pushed toward specific IdP vendors.

IT Director, Reddit

$500/month minimum just to get SCIM feels excessive when we only have 6 analysts who need Metabase access.

SysAdmin, Discord

The recurring theme

While Metabase offers solid SCIM functionality, the Pro plan requirement and Azure AD group limitations create friction for teams trying to implement automated provisioning across their BI workflows.

The decision

Your SituationRecommendation
On Starter, need SCIMUse Stitchflow: avoid the $6K+/year Pro upgrade
On Open Source/self-hosted, need provisioningUse Stitchflow: get SCIM without moving to cloud Pro
Already on Pro or EnterpriseUse native SCIM: you're paying for it
Using Azure AD, need group syncUse Stitchflow: native Azure SCIM is users only
Small BI team, minimal user changesManual may work: but watch for security gaps

The bottom line

Metabase gates SCIM behind Pro/Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Make Metabase workflows AI-native

Metabase gates SCIM behind Pro/Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.

No Pro/Enterprise upgrade required
Less than a week, start to finish (~2 hours of your time)
We maintain the integration layer underneath
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Pro

Prerequisites

SSO must be configured first

Key limitations

  • Pro or Enterprise plan required
  • Azure AD SCIM is users only (no groups)
  • Okta SCIM supports users and groups
  • SCIM token generated in Metabase settings

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Metabase → Provisioning

Required credentials

Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).

Configuration steps

Set Provisioning Mode = Automatic, configure SCIM connection.

Provisioning trigger

Entra provisions based on user/group assignments to the enterprise app.

Sync behavior

Entra provisioning runs on a scheduled cycle (typically every 40 minutes).

Microsoft Entra ID SCIM supports user provisioning only - no group sync. Auth mode: HTTP Header.

Metabase gates SCIM behind Pro/Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Unlock SCIM for
Metabase

Metabase gates SCIM behind Pro/Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.

See how it works
Admin Console
Directory
Applications
Metabase logo
Metabase
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

Holistics logo

Holistics

No SCIM

Business Intelligence

ProvisioningNot Supported
Manual Cost$11,754/yr

Holistics, the self-service business intelligence platform, does not support SCIM provisioning on any plan. While Holistics offers SAML 2.0 SSO integration with major identity providers including Okta and Azure AD, this only handles authentication—users must still be manually created and managed within the Holistics platform. For BI teams that need to rapidly onboard and offboard data analysts and business users across projects, this creates a significant administrative burden that scales poorly with team growth. The gap between SSO authentication and actual user provisioning becomes particularly problematic for data teams managing multiple projects with varying access requirements. Without automated provisioning, IT teams must manually coordinate user creation, role assignments, and deprovisioning across both the identity provider and Holistics platform. This manual process creates compliance risks around orphaned accounts and increases the likelihood of access control errors in environments handling sensitive business data.

View full guide
8x8 logo

8x8

SCIM Tax

UCaaS / Business Communications

SCIM StatusIncluded
Manual Cost$11,754/yr

8x8 supports SCIM 2.0 for automated user provisioning, but only on their quote-based X Series plans (previously $24-44/user/month range before they moved to custom pricing). While SCIM can create, update, and deactivate users, it has critical gaps that create ongoing manual overhead: license assignment must be done manually after every user is provisioned, users can't be deleted (only deactivated), and provisioned users don't automatically appear in the Company Directory. For IT teams managing a unified communications platform that typically covers all employees, these limitations defeat much of SCIM's purpose. You're still manually touching every user account to assign licenses and ensure directory visibility. The lack of user deletion support also creates compliance headaches when employees leave - accounts accumulate as "deactivated" rather than being properly removed.

View full guide
Absorb LMS logo

Absorb LMS

SCIM Tax

Learning Management System (LMS)

SCIM StatusIncluded
Manual Cost$11,754/yr

Absorb LMS supports native SCIM provisioning, but only on Enterprise plans with SSO as a required paid add-on. Even with SCIM enabled, the implementation has critical limitations: SAML provisioning only creates accounts on first login and never updates existing users, and full user provisioning requires the specific "Absorb 5 - New Learner Experience" version. For organizations managing compliance training across hundreds or thousands of learners, these gaps create ongoing manual work. The SSO-as-add-on model means you're paying extra fees on top of already custom Enterprise pricing ($6-12/user/month base, but varies significantly). For learning management systems handling external partners, contractors, and employees across different access levels, the inability to update existing user attributes through SAML provisioning forces IT teams into manual account management—exactly what automated provisioning should eliminate.

View full guide