Stitchflow
Redshift logo

Redshift SCIM guide

Connector Only

How to automate Redshift user provisioning, and what it actually costs

Summary and recommendation

Amazon Redshift supports SCIM 2.0 provisioning, but only through AWS IAM Identity Center (formerly AWS SSO) as an intermediary layer. This means IT teams must first configure their IdP (Okta, Entra, etc.) to provision users into IAM Identity Center, which then federates authentication to Redshift. While this architecture provides full user lifecycle management—including create, update, deactivate, and group sync—it introduces significant operational complexity. Teams must maintain SCIM tokens that expire annually, ensure stable external identifiers across systems, and navigate the multi-step IAM Identity Center setup process that many IT admins find cumbersome.

This federated approach creates a dependency chain where any misconfiguration in IAM Identity Center breaks access to all connected AWS services, including Redshift. For data teams that need reliable access to their data warehouse, this architectural complexity often leads to manual user management workarounds that undermine the entire purpose of automated provisioning. The yearly token expiration requirement also creates an ongoing maintenance burden that catches many teams off-guard.

The strategic alternative

Redshift has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?No
SCIM tier requiredN/A
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaConfigure Okta as IdP for AWS IAM Identity Center, then enable SCIM provisioning. Users/groups sync to IAM Identity Center and access Redshift via federation.
Microsoft Entra IDConfigure Azure AD as IdP for AWS IAM Identity Center with SCIM provisioning. Users/groups sync automatically.
Google WorkspaceVia third-partyNo native support
OneLoginVia third-partyNo native support

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Redshift accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Redshift pricing problem

Redshift gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
ServerlessFrom $1.50/hour
Via IAM Identity Center only
ProvisionedFrom $0.543/hour
Via IAM Identity Center only
Reserved InstancesUp to 75% discount
Via IAM Identity Center only

Pricing structure

PlanPriceSCIM Support
ServerlessFrom $1.50/hourVia IAM Identity Center only
ProvisionedFrom $0.543/hourVia IAM Identity Center only
Reserved InstancesUp to 75% discountVia IAM Identity Center only

Additional costs

IAM Identity Center
Free for AWS SSO use cases
Storage
From $0.024/GB-month
Cross-region data transfer charges may apply

What this means in practice

This third-party dependency creates a multi-step provisioning flow that's prone to delays and troubleshooting complexity:

1. Configure your IdP → IAM Identity Center integration 2. Set up SCIM between IdP and IAM Identity Center 3. Configure federated access from IAM Identity Center → Redshift 4. Map user attributes across three different systems

When provisioning fails, you're troubleshooting across AWS IAM Identity Center, your IdP, and Redshift simultaneously. A single misconfiguration in the IAM Identity Center SAML/SCIM setup breaks access for your entire data team.

Additional constraints

Annual token expiration
SCIM tokens in IAM Identity Center expire yearly, requiring manual renewal
Stable identifier requirement
The externalId field must remain consistent across all systems
Required attribute mapping
First name, last name, username, and display name are all mandatory fields
AWS expertise required
Your IT team needs to understand IAM Identity Center configuration, not just IdP management
Query Editor v2 dependency
Modern Redshift access relies on federated authentication through the web interface

Summary of challenges

  • Redshift does not provide native SCIM at any price tier
  • Organizations must rely on third-party tools or manual provisioning
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What Redshift actually offers for identity

SAML SSO + SCIM (via AWS IAM Identity Center)

Amazon Redshift doesn't have native SCIM. Instead, it relies entirely on AWS IAM Identity Center (formerly AWS SSO) for both authentication and provisioning:

FeatureDetails
ProtocolSAML 2.0 for SSO, SCIM 2.0 for provisioning
Supported IdPsOkta, Azure AD, Google Workspace, OneLogin, PingIdentity
ConfigurationConfigure your IdP as external identity source in IAM Identity Center
User accessUsers authenticate via IAM Identity Center, then access Redshift through federation

What SCIM provides through IAM Identity Center:

Create and update user accounts
Sync group memberships
Deactivate users when removed from IdP
Automatic attribute mapping (firstName, lastName, email)

Key limitations of this approach

Setup complexity: You're not just configuring Redshift—you're configuring an entire AWS identity infrastructure layer. This requires:

Setting up IAM Identity Center in your AWS account
Configuring external identity provider connections
Managing permission sets and assignments
Understanding AWS federated authentication flows

Operational overhead:

SCIM tokens expire annually and must be manually renewed
Changes require coordination between your IdP admin and AWS administrator
Troubleshooting spans multiple AWS services (IAM Identity Center, Redshift, CloudTrail)

Lock-in: This architecture ties your Redshift identity management to AWS IAM Identity Center, making it harder to migrate to other data warehouse solutions.

The bottom line: While technically functional, Redshift's identity approach requires significantly more AWS expertise and ongoing maintenance compared to applications with native SCIM support.

What IT admins are saying

Community sentiment on Redshift's provisioning centers around AWS IAM Identity Center complexity and maintenance overhead:

  • Setting up IAM Identity Center as an intermediary step adds architectural complexity
  • SCIM tokens expire annually, requiring manual renewal to maintain provisioning
  • The federated authentication model creates confusion about where users actually exist
  • Teams need AWS expertise just to configure basic user provisioning for their data warehouse

Requires IAM Identity Center setup... SCIM token expires yearly

AWS Documentation

Configure IdP there, then users access Redshift via federation

Implementation guidance highlighting the multi-step complexity

The recurring theme

Redshift forces IT teams to become AWS identity experts just to provision data warehouse users. The IAM Identity Center requirement adds an extra layer of complexity that most teams didn't expect when choosing a data warehouse solution.

The decision

Your SituationRecommendation
Small data team (<10 analysts)Manual user management via AWS Console
Growing analytics team with AWS expertiseSet up AWS IAM Identity Center with SCIM
Large data organization (30+ users)Use Stitchflow: IAM Identity Center complexity not worth it
Multi-cloud environment with mixed IdPsUse Stitchflow: works with any IdP without AWS lock-in
Enterprise with compliance requirementsUse Stitchflow: automation essential for data access audit trails

The bottom line

Redshift's SCIM provisioning requires setting up AWS IAM Identity Center—a complex enterprise service that most teams don't need just for data warehouse access. For organizations that want Redshift user automation without AWS infrastructure overhead, Stitchflow provides the direct path.

Make Redshift workflows AI-native

Redshift has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.

Covers apps without native SCIM, including the ones without APIs
Less than a week, start to finish (~2 hours of your time)
Built with your team; extend to anything else in the company
Book a Demo

Technical specifications

SCIM Version

Not specified

Supported Operations

Not specified

Supported Attributes

Not specified

Plan requirement

Not specified

Prerequisites

Not specified

Key limitations

  • Requires IAM Identity Center setup
  • SCIM token expires yearly
  • externalId must be stable identifier
  • First/Last/Username/Display required

Configuration for Okta

Integration type

Okta Integration Network (OIN) app

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Okta Admin Console → Applications → Redshift → Sign On

Configure Okta as IdP for AWS IAM Identity Center, then enable SCIM provisioning. Users/groups sync to IAM Identity Center and access Redshift via federation.

Use Stitchflow for automated provisioning.

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Redshift → Single sign-on

Configure Azure AD as IdP for AWS IAM Identity Center with SCIM provisioning. Users/groups sync automatically.

Use Stitchflow for automated provisioning.

Unlock SCIM for
Redshift

Redshift has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.

See how it works
Admin Console
Directory
Applications
Redshift logo
Redshift
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

6sense logo

6sense

No SCIM

B2B Revenue Intelligence / ABM

ProvisioningNot Supported
Manual Cost$11,754/yr

6sense, the B2B revenue intelligence platform, has paused SCIM provisioning for new customers until Q4 2026. While existing customers with SCIM enabled can continue using it, new implementations are limited to JIT (Just-In-Time) provisioning through SAML SSO. This creates a significant gap for IT teams managing revenue intelligence access, as JIT only creates users on first login and provides minimal attribute mapping (email, first name, last name only). For an enterprise platform with typical pricing of $55,000-$130,000 annually, the absence of automated user lifecycle management is a substantial limitation. The lack of SCIM until Q4 2026 forces IT teams into manual provisioning workflows for a platform handling sensitive revenue data. While SAML SSO handles authentication, it doesn't address user lifecycle events like role changes, department transfers, or offboarding. This creates compliance risks in revenue teams where access to prospect data and sales intelligence must be tightly controlled. The nearly two-year wait for SCIM restoration means organizations implementing 6sense today face manual user management for the foreseeable future.

View full guide
Aha! logo

Aha!

No SCIM

Product Management / Roadmapping

ProvisioningNot Supported
Manual Cost$11,754/yr

Aha! Roadmaps, the product roadmapping platform, does not support SCIM provisioning on any plan. While Aha! offers SAML 2.0 SSO integration with identity providers like Okta, Entra ID, and OneLogin, this only handles authentication through JIT (Just-In-Time) provisioning. The critical limitation: JIT provisioning creates user accounts with no default role or access permissions, requiring administrators to manually configure access for each user after they first sign in. For product teams managing strategic roadmaps and stakeholder access, this creates significant operational overhead. Since product roadmaps contain sensitive strategic information and stakeholder access typically varies by product area, IT administrators must manually assign appropriate roles and workspace permissions after each user is provisioned. There's no automatic deprovisioning when users leave the organization, creating potential security gaps. This manual process becomes particularly problematic for larger product organizations where dozens of stakeholders across different business units need carefully managed access to specific roadmaps.

View full guide
Appcues logo

Appcues

No SCIM

Product Adoption / User Onboarding

ProvisioningNot Supported
Manual Cost$11,754/yr

Appcues, the product adoption platform used by product managers and growth teams, explicitly does not support SCIM provisioning on any plan—not even Enterprise. While Appcues offers SAML 2.0 SSO integration starting at the Enterprise tier with just-in-time (JIT) provisioning, this only creates users during first login and provides no automated deprovisioning capabilities. For product teams where access needs change frequently as people move between projects or leave the company, this creates a significant security gap. The lack of SCIM means IT teams must manually manage user lifecycle for Appcues accounts, even though the platform handles sensitive product analytics and user flow data. When employees leave or change roles, their Appcues access remains active until manually revoked—a compliance risk that's particularly problematic given Appcues' role in tracking user behavior and product metrics. With MAU-based pricing starting at $300/month and scaling significantly with usage, paying for orphaned accounts also creates unnecessary cost bloat.

View full guide