Summary and recommendation
Metabase supports SCIM 2.0 for automated user provisioning, but only on Pro ($500/month for 10 users) or Enterprise ($15,000/year minimum) plans. While Okta integration includes full user and group provisioning, Microsoft Entra ID SCIM is limited to users only—no group sync capability. For teams on Starter plans ($5/user/month), upgrading to Pro means jumping to $500/month base cost plus $10 per additional user, a significant expense increase just to unlock provisioning automation.
The Entra ID limitation creates a particular operational gap for data teams. Without group provisioning, IT admins must manually manage dashboard permissions and data access controls in Metabase, defeating much of the automation benefit. This becomes especially problematic as organizations scale their BI initiatives across departments, where group-based access control is essential for maintaining data governance and compliance.
The strategic alternative
Metabase gates SCIM behind Pro/Enterprise. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across the rest of your stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Pro |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Official docs |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ✓ | Gallery app with SCIM |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Metabase accounts manually. Here's what that costs:
The Metabase pricing problem
Metabase gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Open Source | Free (self-hosted) | ||
| Starter | $5/user/mo (cloud only) | ||
| Pro | $500/mo (10 users) + $10/user | ||
| Enterprise | $15,000/year minimum |
Plan Structure
| Plan | Price | SCIM |
|---|---|---|
| Open Source | Free (self-hosted) | ❌ |
| Starter | $5/user/mo (cloud only) | ❌ |
| Pro | $500/mo (10 users) + $10/user | ✓ |
| Enterprise | $15,000/year minimum | ✓ |
Note: Pro plan includes 10 users for $500/month, with additional users at $10/month each. Annual Pro pricing is $5,400/year plus $108/user annually.
What this means in practice
For teams currently on Starter ($5/user/month), the jump to Pro represents a dramatic cost increase:
| Team Size | Current Starter Cost | Pro Plan Cost | Annual Increase |
|---|---|---|---|
| 10 users | $600/year | $6,000/year | +$5,400 |
| 15 users | $900/year | $6,600/year | +$5,700 |
| 25 users | $1,500/year | $7,800/year | +$6,300 |
The Pro plan effectively sets a $6,000/year minimum for SCIM access, regardless of team size.
Additional constraints
Summary of challenges
- Metabase supports SCIM but only at Pro tier (custom pricing)
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Metabase doesn't sell SCIM separately. On Pro ($500/month) and Enterprise ($15,000/year), you get:
Stitchflow Insight
The Pro plan targets teams needing governance controls for BI data access. If you're already managing sensitive data or need embedding features, the upgrade makes business sense. But if you only want basic user provisioning, you're paying $500/month for features most teams won't touch. We estimate ~60% of Pro features are irrelevant for organizations that just need automated user management.
What IT admins are saying
Community sentiment on Metabase's SCIM implementation is mixed, with specific concerns around Azure AD limitations and pricing barriers for smaller teams.
- Azure AD SCIM only supports user provisioning, not group sync
- Pro plan requirement ($500/month minimum) locks out smaller BI teams
- Annual Pro commitment ($5,400/year) feels steep for basic provisioning
- Having to choose between Okta (full SCIM) vs Azure AD (partial SCIM)
The fact that Azure AD SCIM is users only while Okta gets full group support feels like we're being pushed toward specific IdP vendors.
$500/month minimum just to get SCIM feels excessive when we only have 6 analysts who need Metabase access.
The recurring theme
While Metabase offers solid SCIM functionality, the Pro plan requirement and Azure AD group limitations create friction for teams trying to implement automated provisioning across their BI workflows.
The decision
| Your Situation | Recommendation |
|---|---|
| On Starter, need SCIM | Use Stitchflow: avoid the $6K+/year Pro upgrade |
| On Open Source/self-hosted, need provisioning | Use Stitchflow: get SCIM without moving to cloud Pro |
| Already on Pro or Enterprise | Use native SCIM: you're paying for it |
| Using Azure AD, need group sync | Use Stitchflow: native Azure SCIM is users only |
| Small BI team, minimal user changes | Manual may work: but watch for security gaps |
The bottom line
Metabase gates SCIM behind Pro/Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the Metabase workflow gap
Metabase gates SCIM behind Pro/Enterprise, but the bigger issue is the workflow around it. Stitchflow builds and maintains the offboarding, access review, or license workflow underneath.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Pro
Prerequisites
SSO must be configured first
Key limitations
- Pro or Enterprise plan required
- Azure AD SCIM is users only (no groups)
- Okta SCIM supports users and groups
- SCIM token generated in Metabase settings
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).
Configuration steps
Set Provisioning Mode = Automatic, configure SCIM connection.
Provisioning trigger
Entra provisions based on user/group assignments to the enterprise app.
Sync behavior
Entra provisioning runs on a scheduled cycle (typically every 40 minutes).
Microsoft Entra ID SCIM supports user provisioning only - no group sync. Auth mode: HTTP Header.
Metabase gates SCIM behind Pro/Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the workflow gap in
Metabase
Metabase gates SCIM behind Pro/Enterprise plan. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across your stack.
Start with the free gap diagnostic


