Pleo SCIM guide

Payhawk, the corporate card and expense management platform, does not offer SCIM provisioning on any plan. While Payhawk supports SAML 2.0 SSO with major identity providers including Okta, Microsoft Entra, and Google Workspace, this only handles authentication through their Amazon Cognito implementation. User provisioning, deprovisioning, and attribute updates must all be handled manually through the Payhawk admin interface, creating a significant operational burden for IT teams managing employee onboarding and offboarding. This limitation is particularly problematic for corporate card platforms where rapid provisioning and deprovisioning directly impacts financial security. When employees leave or change roles, IT teams must remember to manually revoke access to corporate cards and expense reporting—a process that's both error-prone and creates compliance risks. The gap between SSO authentication and actual user lifecycle management means organizations lose the automation benefits that make SCIM essential for financial applications.

Ramp offers excellent native SCIM support across all plans, including their free tier. Users are automatically created, updated, and deactivated through standard SCIM protocols with major IdPs like Okta and Microsoft Entra. However, several operational limitations create gaps: SCIM deactivation doesn't actually delete users (they remain as "inactive"), corporate card termination requires manual intervention, and you can't run both SCIM and HRIS integrations simultaneously. These limitations matter most for financial compliance and offboarding workflows. When employees leave, their Ramp accounts stay in the system indefinitely, and any active corporate cards remain functional until manually terminated. For finance teams managing hundreds of users and cards, this creates audit trail concerns and potential security exposure from dormant accounts.

6sense, the B2B revenue intelligence platform, has paused SCIM provisioning for new customers until Q4 2026. While existing customers with SCIM enabled can continue using it, new implementations are limited to JIT (Just-In-Time) provisioning through SAML SSO. This creates a significant gap for IT teams managing revenue intelligence access, as JIT only creates users on first login and provides minimal attribute mapping (email, first name, last name only). For an enterprise platform with typical pricing of $55,000-$130,000 annually, the absence of automated user lifecycle management is a substantial limitation. The lack of SCIM until Q4 2026 forces IT teams into manual provisioning workflows for a platform handling sensitive revenue data. While SAML SSO handles authentication, it doesn't address user lifecycle events like role changes, department transfers, or offboarding. This creates compliance risks in revenue teams where access to prospect data and sales intelligence must be tightly controlled. The nearly two-year wait for SCIM restoration means organizations implementing 6sense today face manual user management for the foreseeable future.