Summary and recommendation
Metabase supports SCIM 2.0 for automated user provisioning, but only on Pro ($500/month for 10 users) or Enterprise ($15,000/year minimum) plans. While Okta integration includes full user and group provisioning, Microsoft Entra ID SCIM is limited to users only—no group sync capability. For teams on Starter plans ($5/user/month), upgrading to Pro means jumping to $500/month base cost plus $10 per additional user, a significant expense increase just to unlock provisioning automation.
The Entra ID limitation creates a particular operational gap for data teams. Without group provisioning, IT admins must manually manage dashboard permissions and data access controls in Metabase, defeating much of the automation benefit. This becomes especially problematic as organizations scale their BI initiatives across departments, where group-based access control is essential for maintaining data governance and compliance.
The strategic alternative
Metabase gates SCIM behind Pro/Enterprise. Skip the Pro/Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Pro |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Official docs |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ✓ | Gallery app with SCIM |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Metabase accounts manually. Here's what that costs:
The Metabase pricing problem
Metabase gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Open Source | Free (self-hosted) | ||
| Starter | $5/user/mo (cloud only) | ||
| Pro | $500/mo (10 users) + $10/user | ||
| Enterprise | $15,000/year minimum |
Plan Structure
| Plan | Price | SCIM |
|---|---|---|
| Open Source | Free (self-hosted) | ❌ |
| Starter | $5/user/mo (cloud only) | ❌ |
| Pro | $500/mo (10 users) + $10/user | ✓ |
| Enterprise | $15,000/year minimum | ✓ |
Note: Pro plan includes 10 users for $500/month, with additional users at $10/month each. Annual Pro pricing is $5,400/year plus $108/user annually.
What this means in practice
For teams currently on Starter ($5/user/month), the jump to Pro represents a dramatic cost increase:
| Team Size | Current Starter Cost | Pro Plan Cost | Annual Increase |
|---|---|---|---|
| 10 users | $600/year | $6,000/year | +$5,400 |
| 15 users | $900/year | $6,600/year | +$5,700 |
| 25 users | $1,500/year | $7,800/year | +$6,300 |
The Pro plan effectively sets a $6,000/year minimum for SCIM access, regardless of team size.
Additional constraints
Summary of challenges
- Metabase supports SCIM but only at Pro tier (custom pricing)
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Metabase doesn't sell SCIM separately. On Pro ($500/month) and Enterprise ($15,000/year), you get:
Stitchflow Insight
The Pro plan targets teams needing governance controls for BI data access. If you're already managing sensitive data or need embedding features, the upgrade makes business sense. But if you only want basic user provisioning, you're paying $500/month for features most teams won't touch. We estimate ~60% of Pro features are irrelevant for organizations that just need automated user management.
What IT admins are saying
Community sentiment on Metabase's SCIM implementation is mixed, with specific concerns around Azure AD limitations and pricing barriers for smaller teams.
- Azure AD SCIM only supports user provisioning, not group sync
- Pro plan requirement ($500/month minimum) locks out smaller BI teams
- Annual Pro commitment ($5,400/year) feels steep for basic provisioning
- Having to choose between Okta (full SCIM) vs Azure AD (partial SCIM)
The fact that Azure AD SCIM is users only while Okta gets full group support feels like we're being pushed toward specific IdP vendors.
$500/month minimum just to get SCIM feels excessive when we only have 6 analysts who need Metabase access.
The recurring theme
While Metabase offers solid SCIM functionality, the Pro plan requirement and Azure AD group limitations create friction for teams trying to implement automated provisioning across their BI workflows.
The decision
| Your Situation | Recommendation |
|---|---|
| On Starter, need SCIM | Use Stitchflow: avoid the $6K+/year Pro upgrade |
| On Open Source/self-hosted, need provisioning | Use Stitchflow: get SCIM without moving to cloud Pro |
| Already on Pro or Enterprise | Use native SCIM: you're paying for it |
| Using Azure AD, need group sync | Use Stitchflow: native Azure SCIM is users only |
| Small BI team, minimal user changes | Manual may work: but watch for security gaps |
The bottom line
Metabase gates SCIM behind Pro/Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.
Make Metabase workflows AI-native
Metabase gates SCIM behind Pro/Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Pro
Prerequisites
SSO must be configured first
Key limitations
- Pro or Enterprise plan required
- Azure AD SCIM is users only (no groups)
- Okta SCIM supports users and groups
- SCIM token generated in Metabase settings
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).
Configuration steps
Set Provisioning Mode = Automatic, configure SCIM connection.
Provisioning trigger
Entra provisions based on user/group assignments to the enterprise app.
Sync behavior
Entra provisioning runs on a scheduled cycle (typically every 40 minutes).
Microsoft Entra ID SCIM supports user provisioning only - no group sync. Auth mode: HTTP Header.
Metabase gates SCIM behind Pro/Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.
Unlock SCIM for
Metabase
Metabase gates SCIM behind Pro/Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.
See how it works


