Summary and recommendation
Pipedrive does not offer native SCIM provisioning on any documented plan. While the CRM platform provides SAML SSO on its Ultimate tier and has an Okta connector that offers some provisioning capabilities, there's no standardized SCIM API available across identity providers. This creates a fragmented provisioning experience where Okta users get connector-based automation while teams using Microsoft Entra ID, Google Workspace, or other IdPs have no automated provisioning options at all.
The lack of native SCIM support means IT teams face manual user management overhead that scales poorly as sales teams grow. Without standardized provisioning, onboarding new sales reps requires manual account creation in Pipedrive, and offboarding risks leaving orphaned accounts with access to sensitive sales data and customer information. For organizations using non-Okta identity providers, this creates a significant compliance gap where user access isn't centrally managed through your IdP.
The strategic alternative
Pipedrive gates SCIM behind Ultimate (SSO required). That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across the rest of your stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ❌ | SSO only |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Pipedrive accounts manually. Here's what that costs:
The Pipedrive pricing problem
Pipedrive gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Lite | $14/seat/month | ||
| Growth | $39/seat/month | ||
| Premium | $49/seat/month | ||
| Ultimate | Custom pricing |
Pricing structure
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Lite | $14/seat/month | ||
| Growth | $39/seat/month | ||
| Premium | $49/seat/month | ||
| Ultimate | Custom pricing |
Note: Okta users can access some provisioning features through Okta's Pipedrive connector, but this isn't native SCIM and has platform-specific limitations.
What this means in practice
For Okta customers
For Entra ID customers
For Google Workspace customers
Additional constraints
Summary of challenges
- Pipedrive supports SCIM but only at Enterprise tier (custom pricing)
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Pipedrive actually offers for identity
Pipedrive doesn't offer native SCIM provisioning on any documented plan. Instead, you get a fragmented identity experience that varies by IdP:
SAML SSO (Ultimate plan required)
Okta-specific provisioning (connector-based)
Manual user management (all other IdPs)
The core problem: Pipedrive gatekeeps basic SSO behind expensive custom pricing while offering no standardized SCIM API. Okta users get limited connector-based provisioning, but teams using Entra ID, Google Workspace, or other IdPs are stuck with manual account management. This creates compliance gaps where user access isn't centrally managed and offboarding risks leaving orphaned accounts with access to sensitive sales data.
For organizations that need reliable provisioning automation across any identity provider, Pipedrive's current offerings fall significantly short of enterprise requirements.
What IT admins are saying
Community sentiment on Pipedrive's provisioning reveals frustration with unclear automation options and high SSO barriers:
- Native SCIM support is completely undocumented - IT teams can't determine what provisioning capabilities actually exist
- SSO requires the Ultimate plan with custom pricing, making it inaccessible for smaller teams on standard tiers
- Okta users get some provisioning through a connector, but other IdP users are left guessing about automation options
- Email address matching requirements are strict, including exact capitalization, creating login failures
Email addresses must match exactly (including capitalization)
Single Sign-On is available on the Ultimate tier
The recurring theme
Pipedrive keeps IT teams in the dark about provisioning capabilities while gatekeeping basic SSO behind expensive custom pricing, forcing manual user management for most customers.
The decision
| Your Situation | Recommendation |
|---|---|
| Small sales team (<20 users) on Growth/Premium plans | Manual management is acceptable for now |
| Ultimate plan with Okta integration | Try Okta connector first, but expect IdP lock-in |
| Growing sales organization (30+ users) | Use Stitchflow: automation essential for scaling |
| Enterprise with compliance requirements | Use Stitchflow: audit trail and governance critical |
| Multi-IdP environment or non-Okta setup | Use Stitchflow: native SCIM unclear, broad IdP support needed |
The bottom line
Pipedrive gates SCIM behind Ultimate (SSO required). The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the Pipedrive workflow gap
Pipedrive gates SCIM behind Ultimate (SSO required), but the bigger issue is the workflow around it. Stitchflow builds and maintains the offboarding, access review, or license workflow underneath.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
None
Key limitations
- SSO requires Ultimate plan
- Native SCIM not documented
- Okta connector may provide provisioning
- Email addresses must match exactly (including capitalization)
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
Docs
Okta integration supports SSO and provisioning capabilities. Includes Schema Discovery and Attribute Writeback. Native SCIM not documented - provisioning via Okta connector.
Pipedrive gates SCIM behind Ultimate (SSO required). The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app
Where to enable
SSO only with Microsoft Entra ID. Email addresses must match exactly. Native SCIM provisioning not documented for Entra.
Use Stitchflow for automated provisioning.
Close the workflow gap in
Pipedrive
Pipedrive gates SCIM behind Ultimate (SSO required) plan. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across your stack.
Start with the free gap diagnostic


