Summary and recommendation
NICE CXone supports native SCIM provisioning, but only for users on Enterprise-tier plans ($135-$249/user/month). The implementation requires navigating regional SCIM endpoints (na1, eu, etc.), OAuth 2 authentication setup, and coordination with NICE's support team for SAML configuration. While SCIM can create, update, and deactivate users, it's limited to SP-initiated SSO and requires users to have Agent roles for provisioning to work properly.
For contact centers on lower-tier plans (Digital Agent at $71/user/month or Voice Agent at $94/user/month), this creates a significant gap. These organizations still need automated user lifecycle management—agents frequently onboard, transfer between teams, or leave—but upgrading to Enterprise just for SCIM nearly doubles licensing costs. A 50-agent contact center would pay an additional $96,000/year moving from Voice Agent to Essential Suite solely to unlock provisioning automation.
The strategic alternative
NICE CXone gates SCIM behind Enterprise. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across the rest of your stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0, OpenID Connect |
| Documentation | Official docs |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ❌ | SSO only |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages NICE CXone accounts manually. Here's what that costs:
The NICE CXone pricing problem
NICE CXone gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Digital Agent | $71/user/mo | ||
| Voice Agent | $94/user/mo | ||
| Omnichannel Agent | $110/user/mo | ||
| Essential Suite | $135/user/mo | ||
| Core Suite | $169/user/mo | ||
| Complete Suite | $209/user/mo | ||
| Ultimate Suite | $249/user/mo |
Plan Structure (Per User, Monthly)
| Plan | Price | SCIM |
|---|---|---|
| Digital Agent | $71/user/mo | ❌ |
| Voice Agent | $94/user/mo | ❌ |
| Omnichannel Agent | $110/user/mo | ❌ |
| Essential Suite | $135/user/mo | ❌ |
| Core Suite | $169/user/mo | ❌ |
| Complete Suite | $209/user/mo | ❌ |
| Ultimate Suite | $249/user/mo | ✓ |
Note: SCIM is only available with the Ultimate Suite tier, which includes end-to-end AI automation features that most contact centers don't need for basic provisioning.
What this means in practice
The jump to Ultimate Suite creates substantial cost increases for SCIM access:
| Current Plan | Team Size | Annual Upgrade Cost |
|---|---|---|
| Digital Agent → Ultimate | 50 agents | +$106,800/year |
| Voice Agent → Ultimate | 100 agents | +$186,000/year |
| Omnichannel → Ultimate | 200 agents | +$332,400/year |
Calculation: (Ultimate Suite price - current plan price) × agents × 12 months
Additional constraints
Summary of challenges
- NICE CXone supports SCIM but only at Enterprise tier (custom pricing)
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
NICE CXone doesn't sell SCIM separately—it's bundled into their Enterprise tier starting at $135/user/month (Essential Suite). Here's what you get:
The challenge: you're paying contact center rates ($1,620+ per user annually) for identity management. Most organizations need maybe 20% of CXone's feature set—the rest is contact center functionality like call routing, quality scoring, and agent coaching that's irrelevant if you just want automated user provisioning.
Even worse, CXone requires their support team to configure SAML SSO, and SCIM endpoints vary by region (na1, eu, etc.), adding deployment complexity that dedicated identity tools handle automatically.
What IT admins are saying
Community sentiment on NICE CXone's SCIM implementation reveals frustration with complexity and support dependencies. Common complaints:
- Regional SCIM endpoint confusion causing failed provisioning setups
- Requiring support team involvement for basic SAML configuration
- SP-initiated SSO limitations preventing seamless user flows
- OAuth 2 authentication complexity for SCIM connections
Had to open three support tickets just to get the right regional SCIM URL configured. Why isn't this documented clearly?
Support team has to manually configure SAML certificates - feels like we're back in 2015.
The recurring theme
NICE CXone's SCIM works but requires significant support involvement and regional endpoint management that creates unnecessary friction for IT teams managing contact center provisioning.
The decision
| Your Situation | Recommendation |
|---|---|
| Need SCIM but not on Enterprise tier | Use Stitchflow: avoid the $135-249/user/mo Enterprise requirement |
| Using Entra ID for identity management | Use Stitchflow: no native SCIM support for Microsoft Entra |
| Multi-region deployment with complex SCIM setup | Use Stitchflow: eliminate regional endpoint management complexity |
| Already on Enterprise with Okta | Use native SCIM: you're paying for Enterprise features |
| Small contact center with low agent turnover | Manual may work: but monitor for security gaps during agent ramp-ups |
The bottom line
NICE CXone gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the NICE CXone workflow gap
NICE CXone gates SCIM behind Enterprise, but the bigger issue is the workflow around it. Stitchflow builds and maintains the offboarding, access review, or license workflow underneath.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
SSO must be configured first
Key limitations
- Regional SCIM URLs (na1, eu, etc.)
- SP-initiated SSO only
- OAuth 2 for SCIM authentication
- Support team needed for SSO config
- Requires Agent role for provisioning
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
Nice inContact app in OIN with SCIM provisioning. Supports Create Users, Update User Attributes, Deactivate Users. Regional SCIM base URL format: https://(region).nice-incontact.com/scim/v2. Uses OAuth 2 authentication with client ID/secret from SCIM app registration.
NICE CXone gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Microsoft Entra ID gallery app for SSO only. SP-initiated SSO supported. Users must be created manually or via CXone support team. No documented SCIM provisioning for Entra.
Use Stitchflow for automated provisioning.
Close the workflow gap in
NICE CXone
NICE CXone gates SCIM behind Enterprise plan. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across your stack, and it can add a 251% markup just to get there.
Start with the free gap diagnostic
