Stitchflow
Pulumi logo

Pulumi SCIM guide

Native SCIM

How to automate Pulumi user provisioning, and what it actually costs

Native SCIM requires Enterprise plan

Summary and recommendation

Pulumi offers comprehensive SCIM 2.0 support with full user and group provisioning capabilities. However, SCIM is gated behind the Enterprise plan, which starts at $32,850/year via AWS Marketplace or usage-based pricing at $0.0005/resource/hour. This creates a significant barrier for smaller teams who need automated provisioning but can't justify enterprise-level infrastructure spending. Additionally, Pulumi requires SAML SSO to be configured before SCIM can be enabled, and enforces strict limitations like immutable usernames and a 40-character limit on team names.

For teams currently on Team plans (usage-based at $0.00025/resource/hour), upgrading to Enterprise solely for SCIM doubles your resource costs. A mid-sized team managing infrastructure could easily face $20,000+ in additional annual costs just to unlock automated user provisioning - costs that compound as your infrastructure scales.

The strategic alternative

Pulumi gates SCIM behind Enterprise. Skip the Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredEnterprise
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDGallery app with SCIM
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Pulumi accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Pulumi pricing problem

Pulumi gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Plan Structure

PlanPriceSSOSCIM
Individual$0 (500 deploy minutes)
Team$0.00025/resource/hour
Enterprise$0.0005/resource/hour or $32,850/year
Business Critical$50,000+/year

What this means in practice

Pulumi's usage-based pricing makes cost projections challenging, but the Enterprise tier doubles your resource costs compared to Team pricing. For organizations running substantial infrastructure:

Resource-based pricing impact

1,000 resources running continuously
~$365/month → ~$730/month (+$4,380/year)
5,000 resources running continuously
~$1,825/month → ~$3,650/month (+$21,900/year)

AWS Marketplace option: Fixed $32,850/year eliminates usage surprises but represents significant upfront commitment.

Additional constraints

SAML prerequisite
You must configure SAML SSO before enabling SCIM provisioning, adding implementation complexity.
Single SCIM app limit
Each Pulumi organization supports only one SCIM application, limiting flexibility for complex IdP setups.
Team name restrictions
SCIM-provisioned teams have a 40-character name limit, potentially breaking existing naming conventions.
Immutable usernames
Once created via SCIM, usernames cannot be changed, requiring careful initial configuration.
Usage prediction difficulty
Resource-based pricing makes it hard to predict the true cost impact of upgrading for SCIM access.

Summary of challenges

  • Pulumi supports SCIM but only at Enterprise tier ($0.0005/resource/hour (~$0.365/resource/month) or $32,850/year via AWS Marketplace)
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

Pulumi doesn't sell SCIM à la carte. It's bundled with Enterprise features:

SCIM 2.0 automated provisioning with group sync
SAML single sign-on (required prerequisite)
Advanced organization management
Role-based access controls (RBAC)
Audit logging and compliance reporting
Private package hosting
Advanced policy enforcement
Dedicated customer success management

The usage-based pricing model ($0.0005/resource/hour) also means costs scale unpredictably with your infrastructure footprint, making budgeting difficult for growing teams.

Stitchflow Insight

The Enterprise tier targets large-scale infrastructure teams with complex compliance requirements. If you just need automated user provisioning for your DevOps team, you're paying for enterprise governance features you likely won't use. We estimate ~60% of Enterprise features are irrelevant for teams that only need SCIM automation.

What IT admins are saying

Community sentiment on Pulumi's SCIM implementation is generally positive, but cost concerns dominate the conversation. Common complaints:

  • Enterprise plan requirement creates a significant pricing barrier for smaller teams
  • Usage-based pricing model makes SCIM costs unpredictable and potentially expensive
  • The $32,850/year marketplace minimum feels excessive for basic identity automation
  • Having to estimate resource hours to budget for what should be standard security features

We wanted SCIM but the Enterprise pricing model is just not feasible for our team size. The resource-based billing makes it impossible to predict what we'll actually pay.

DevOps Engineer, Reddit

Why is user provisioning locked behind a $30K+ paywall? Every other tool we use includes this in their standard plans.

Platform Team Lead, HackerNews

The recurring theme

Pulumi's usage-based Enterprise pricing creates both cost barriers and budgeting uncertainty, making basic identity automation inaccessible to many teams despite solid technical implementation.

The decision

Your SituationRecommendation
On Team plan, need SCIMUse Stitchflow: avoid the Enterprise upgrade and usage-based costs
Small resource footprint, worried about Enterprise pricingUse Stitchflow: flat $5K/year vs. unpredictable resource-based billing
Already on Enterprise planUse native SCIM: you're paying for it and it's well-implemented
Need Enterprise features beyond SCIMEvaluate Enterprise: SCIM comes bundled with advanced security
Low user churn, simple team structureManual may work: but monitor for security gaps in a DevOps context

The bottom line

Pulumi's Enterprise requirement means SCIM comes with usage-based pricing that can quickly escalate beyond $32K/year for active infrastructure teams. For organizations on Team plans that need provisioning automation without the Enterprise commitment, Stitchflow delivers the same user lifecycle management at predictable flat-rate pricing.

Make Pulumi workflows AI-native

Pulumi gates SCIM behind Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.

No Enterprise upgrade required
Less than a week, start to finish (~2 hours of your time)
We maintain the integration layer underneath
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Enterprise

Prerequisites

SSO must be configured first

Key limitations

  • Enterprise plan required for SCIM
  • One SCIM app per Pulumi org
  • Team name 40 char limit for SCIM
  • SAML required before SCIM
  • Usernames are immutable

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Pulumi → Provisioning

Required credentials

Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).

Configuration steps

Set Provisioning Mode = Automatic, configure SCIM connection.

Provisioning trigger

Entra provisions based on user/group assignments to the enterprise app.

Sync behavior

Entra provisioning runs on a scheduled cycle (typically every 40 minutes).

Full SCIM 2.0 support. Configure userName for creation only. Scope to assigned users/groups only.

Pulumi gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Unlock SCIM for
Pulumi

Pulumi gates SCIM behind Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.

See how it works
Admin Console
Directory
Applications
Pulumi logo
Pulumi
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

8x8 logo

8x8

SCIM Tax

UCaaS / Business Communications

SCIM StatusIncluded
Manual Cost$11,754/yr

8x8 supports SCIM 2.0 for automated user provisioning, but only on their quote-based X Series plans (previously $24-44/user/month range before they moved to custom pricing). While SCIM can create, update, and deactivate users, it has critical gaps that create ongoing manual overhead: license assignment must be done manually after every user is provisioned, users can't be deleted (only deactivated), and provisioned users don't automatically appear in the Company Directory. For IT teams managing a unified communications platform that typically covers all employees, these limitations defeat much of SCIM's purpose. You're still manually touching every user account to assign licenses and ensure directory visibility. The lack of user deletion support also creates compliance headaches when employees leave - accounts accumulate as "deactivated" rather than being properly removed.

View full guide
Absorb LMS logo

Absorb LMS

SCIM Tax

Learning Management System (LMS)

SCIM StatusIncluded
Manual Cost$11,754/yr

Absorb LMS supports native SCIM provisioning, but only on Enterprise plans with SSO as a required paid add-on. Even with SCIM enabled, the implementation has critical limitations: SAML provisioning only creates accounts on first login and never updates existing users, and full user provisioning requires the specific "Absorb 5 - New Learner Experience" version. For organizations managing compliance training across hundreds or thousands of learners, these gaps create ongoing manual work. The SSO-as-add-on model means you're paying extra fees on top of already custom Enterprise pricing ($6-12/user/month base, but varies significantly). For learning management systems handling external partners, contractors, and employees across different access levels, the inability to update existing user attributes through SAML provisioning forces IT teams into manual account management—exactly what automated provisioning should eliminate.

View full guide
Airbase logo

Airbase

SCIM Tax

Spend Management / Corporate Cards

SCIM StatusIncluded
Manual Cost$11,754/yr

Airbase supports SCIM provisioning, but only on Enterprise plans starting around $8,500/year. While SCIM works with all major identity providers (Okta, Entra ID, Google Workspace), the Enterprise requirement creates a significant barrier for smaller finance teams who need automated provisioning for spend management but can't justify enterprise-level spend management software costs. This creates a particular challenge in finance applications where rapid provisioning and deprovisioning is critical for corporate card access and financial controls. Manual user management means delayed access for new employees needing corporate cards, and more critically, potential security gaps when departing employees retain access to spend management systems. For finance teams handling sensitive financial data and corporate spending, these delays and oversights create both operational friction and compliance risks.

View full guide