Stitchflow
Retool logo

Retool SCIM guide

Native SCIM

How to automate Retool user provisioning, and what it actually costs

Native SCIM requires Enterprise plan

Summary and recommendation

Retool supports SCIM (the protocol that lets your identity provider automatically create, update, and remove user accounts). But Retool gates SCIM functionality behind its Enterprise subscription, which typically costs $94K-$156K/year for a mixed team of 50 standard users and 200 end users. That's a massive jump from Business plans, often representing a 10x+ increase just to unlock automated provisioning.

This Enterprise lock-in is particularly problematic for internal tool teams. Retool applications often span multiple departments—developers building tools, ops teams managing infrastructure, support staff accessing dashboards, and business analysts consuming reports. Without SCIM, IT teams face constant manual provisioning as teams scale and roles change. The alternative of using JIT provisioning alone creates security gaps, as departing employees retain access until someone manually remembers to revoke it.

The strategic alternative

Retool gates SCIM behind Enterprise. Skip the Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredEnterprise
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0, OIDC
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDGallery app with SCIM
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Retool accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Retool pricing problem

Retool gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Plan Structure

PlanPriceSSOSCIM
Team$10/user/mo
BusinessCustom
EnterpriseCustom (typical: $94K-$156K/yr for 50 standard + 200 end users)

Note: Retool uses differentiated pricing between "standard users" (developers/builders) and "end users" (app consumers), with Enterprise typically running $94K-$156K annually for mixed user bases.

What this means in practice

The Enterprise requirement creates a substantial cost barrier since Business pricing is already custom. Based on typical Enterprise implementations:

User MixEstimated Enterprise Costvs. Team Plan ($10/user/mo)
25 standard + 100 end users~$75K/year+$60K/year
50 standard + 200 end users~$125K/year+$95K/year
100 standard + 300 end users~$200K/year+$152K/year

These represent order-of-magnitude increases from self-serve pricing.

Additional constraints

No self-serve Enterprise
Must go through sales process to access SCIM, adding procurement friction.
Azure SCIM complexity
Requires adding aadOptscim062020 flag to Tenant URL for SCIM 2.0 compliance—an undocumented requirement that causes initial setup failures.
Group Push limitations
Requires self-hosted deployment version 2.94+ for group synchronization.
Bearer token dependency
SCIM authentication relies on bearer tokens rather than more secure certificate-based methods.

Summary of challenges

  • Retool supports SCIM but only at Enterprise tier (Custom (typical: $94K-$156K/yr for 50 standard + 200 end users))
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

Retool doesn't sell SCIM separately. It's exclusively bundled with Enterprise subscriptions that include extensive platform features:

SCIM automated provisioning (including Group Push on self-hosted v2.94+)
SAML 2.0 and OIDC single sign-on
Advanced role-based access controls
Custom branding and white-labeling
Audit logs and compliance reporting
Priority support with dedicated success management
On-premises deployment options
Advanced workflow automation features
Custom resource limits and SLA guarantees

Stitchflow Insight

The Enterprise tier is designed for large organizations building complex internal tooling ecosystems. If you're primarily seeking automated user provisioning for a smaller development team, you're paying for enterprise-grade features like custom branding, audit compliance, and dedicated support that may be overkill. We estimate ~60% of Enterprise features are irrelevant for teams that simply need SCIM to manage developer and ops staff access to internal tools.

What IT admins are saying

Community sentiment on Retool's SCIM requirements centers around Enterprise lock-in and Azure integration complexity. Common complaints:

  • Being forced into Enterprise subscriptions just for SSO and SCIM access
  • Azure AD requiring obscure URL modifications (aadOptscim062020 flag) for SCIM compliance
  • No middle-tier option between Business and Enterprise for basic identity features
  • Custom pricing making it difficult to budget for essential security features

Enterprise lock-in for SSO/SCIM is frustrating when you just need basic identity management

Reddit r/sysadmin

The Azure SCIM setup requiring URL modifications feels unnecessarily complex compared to other apps

IT Admin Forum

The recurring theme

Retool gates essential identity management behind Enterprise tiers with custom pricing, while adding technical complexity that shouldn't exist for standard SCIM implementations.

The decision

Your SituationRecommendation
On Team/Business, need SCIMUse Stitchflow: avoid the $94K+ Enterprise upgrade
Already on EnterpriseUse native SCIM: you're paying for it
Self-hosted with technical teamConsider native SCIM: configure SCIM 2.0 endpoints
Need both SCIM and advanced Enterprise featuresEvaluate Enterprise: SCIM comes bundled with governance tools
Small development team, low turnoverManual may work: but watch for developer access sprawl

The bottom line

Retool gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Make Retool workflows AI-native

Retool gates SCIM behind Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.

No Enterprise upgrade required
Less than a week, start to finish (~2 hours of your time)
We maintain the integration layer underneath
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Enterprise

Prerequisites

SSO must be configured first

Key limitations

  • Enterprise subscription required for custom auth
  • Azure requires aadOptscim062020 in Tenant URL for SCIM 2.0 compliance
  • Bearer token authentication required
  • Group Push requires self-hosted v2.94+

Configuration for Okta

Integration type

Okta Integration Network (OIN) app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Okta Admin Console → Applications → Retool → Provisioning

Required credentials

SCIM endpoint URL and bearer token (generated in app admin console).

Configuration steps

Enable Create Users, Update User Attributes, and Deactivate Users.

Provisioning trigger

Okta provisions based on app assignments (users or groups).

Full SCIM support with user creation, updates, deactivation, and Group Push. Retool domain required during setup (without https:// prefix).

Retool gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Retool → Provisioning

Required credentials

Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).

Configuration steps

Set Provisioning Mode = Automatic, configure SCIM connection.

Provisioning trigger

Entra provisions based on user/group assignments to the enterprise app.

Sync behavior

Entra provisioning runs on a scheduled cycle (typically every 40 minutes).

Requires aadOptscim062020 flag in Tenant URL for SCIM 2.0 compliance. Some users report issues with name attribute updates.

Retool gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Unlock SCIM for
Retool

Retool gates SCIM behind Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.

See how it works
Admin Console
Directory
Applications
Retool logo
Retool
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

8x8 logo

8x8

SCIM Tax

UCaaS / Business Communications

SCIM StatusIncluded
Manual Cost$11,754/yr

8x8 supports SCIM 2.0 for automated user provisioning, but only on their quote-based X Series plans (previously $24-44/user/month range before they moved to custom pricing). While SCIM can create, update, and deactivate users, it has critical gaps that create ongoing manual overhead: license assignment must be done manually after every user is provisioned, users can't be deleted (only deactivated), and provisioned users don't automatically appear in the Company Directory. For IT teams managing a unified communications platform that typically covers all employees, these limitations defeat much of SCIM's purpose. You're still manually touching every user account to assign licenses and ensure directory visibility. The lack of user deletion support also creates compliance headaches when employees leave - accounts accumulate as "deactivated" rather than being properly removed.

View full guide
Absorb LMS logo

Absorb LMS

SCIM Tax

Learning Management System (LMS)

SCIM StatusIncluded
Manual Cost$11,754/yr

Absorb LMS supports native SCIM provisioning, but only on Enterprise plans with SSO as a required paid add-on. Even with SCIM enabled, the implementation has critical limitations: SAML provisioning only creates accounts on first login and never updates existing users, and full user provisioning requires the specific "Absorb 5 - New Learner Experience" version. For organizations managing compliance training across hundreds or thousands of learners, these gaps create ongoing manual work. The SSO-as-add-on model means you're paying extra fees on top of already custom Enterprise pricing ($6-12/user/month base, but varies significantly). For learning management systems handling external partners, contractors, and employees across different access levels, the inability to update existing user attributes through SAML provisioning forces IT teams into manual account management—exactly what automated provisioning should eliminate.

View full guide
Airbase logo

Airbase

SCIM Tax

Spend Management / Corporate Cards

SCIM StatusIncluded
Manual Cost$11,754/yr

Airbase supports SCIM provisioning, but only on Enterprise plans starting around $8,500/year. While SCIM works with all major identity providers (Okta, Entra ID, Google Workspace), the Enterprise requirement creates a significant barrier for smaller finance teams who need automated provisioning for spend management but can't justify enterprise-level spend management software costs. This creates a particular challenge in finance applications where rapid provisioning and deprovisioning is critical for corporate card access and financial controls. Manual user management means delayed access for new employees needing corporate cards, and more critically, potential security gaps when departing employees retain access to spend management systems. For finance teams handling sensitive financial data and corporate spending, these delays and oversights create both operational friction and compliance risks.

View full guide