Puppet SCIM guide

SaltStack Config (formerly VMware Aria Automation Config, now part of Broadcom's portfolio) does not support SCIM provisioning on any plan. While the platform offers SAML 2.0 SSO with just-in-time provisioning through identity providers like Okta, Entra ID, and Google Workspace, this creates a significant operational gap: users provisioned via SAML cannot be deleted through the SaltStack UI. This limitation forces IT teams into a hybrid management model where user creation happens automatically but deprovisioning requires manual intervention or API scripting. The lack of proper SCIM support creates compliance risks for organizations managing critical infrastructure automation. When employees leave or change roles, their access to configuration management systems must be revoked immediately—but SaltStack's SAML-only approach leaves IT teams with no clean way to handle lifecycle management. The platform's limit of only 2 SAML providers simultaneously further constrains enterprise identity architecture options.

6sense, the B2B revenue intelligence platform, has paused SCIM provisioning for new customers until Q4 2026. While existing customers with SCIM enabled can continue using it, new implementations are limited to JIT (Just-In-Time) provisioning through SAML SSO. This creates a significant gap for IT teams managing revenue intelligence access, as JIT only creates users on first login and provides minimal attribute mapping (email, first name, last name only). For an enterprise platform with typical pricing of $55,000-$130,000 annually, the absence of automated user lifecycle management is a substantial limitation. The lack of SCIM until Q4 2026 forces IT teams into manual provisioning workflows for a platform handling sensitive revenue data. While SAML SSO handles authentication, it doesn't address user lifecycle events like role changes, department transfers, or offboarding. This creates compliance risks in revenue teams where access to prospect data and sales intelligence must be tightly controlled. The nearly two-year wait for SCIM restoration means organizations implementing 6sense today face manual user management for the foreseeable future.

ActiveCampaign, the marketing automation platform, does not offer native SCIM provisioning on any plan. While the Enterprise plan ($145+/month) includes SAML 2.0 SSO with just-in-time (JIT) provisioning, this only creates user accounts on first login—there's no automated deprovisioning when employees leave or change roles. New SSO users are automatically added to a generic "SSO Users" group with configurable permissions, but IT teams have no way to programmatically manage user lifecycles or enforce granular access controls based on department or role changes. This creates a significant gap for marketing teams that need to manage access to customer data and campaign tools. When employees leave the company or change departments, their ActiveCampaign access must be manually revoked, creating compliance risks and potential data exposure. The lack of automated deprovisioning means former employees could theoretically retain access to sensitive marketing data and customer information until someone manually removes them from the platform.