Stitchflow
SAP Commerce logo

SAP Commerce SCIM guide

Native SCIM

How to automate SAP Commerce user provisioning, and what it actually costs

Native SCIM requires Enterprise plan

Summary and recommendation

SAP Commerce supports SCIM provisioning, but only through SAP's Cloud Identity Services (IPS) acting as an intermediary proxy. This means you can't provision directly from your IdP to SAP Commerce—instead, your identity provider provisions to SAP IPS, which then provisions to Commerce. This architecture requires Enterprise-level licensing ($150,000-$500,000+/year) and adds complexity with multiple integration points across the SAP ecosystem.

The proxy requirement creates operational overhead and potential failure points. IT teams must manage SAP IPS configurations, troubleshoot multi-hop provisioning flows, and maintain expertise in SAP's identity architecture alongside their primary IdP. When provisioning fails, determining whether the issue is between your IdP and SAP IPS, or between SAP IPS and Commerce, becomes a time-consuming diagnostic exercise.

The strategic alternative

SAP Commerce gates SCIM behind Enterprise. Skip the Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredEnterprise
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDGallery app with SCIM
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages SAP Commerce accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The SAP Commerce pricing problem

SAP Commerce gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
ComposableContact SAP
PremierContact SAP
Enterprise$150,000-$500,000+/year

Plan Structure

PlanPriceSCIM
ComposableContact SAP✓ (via SAP IPS)
PremierContact SAP✓ (via SAP IPS)
Enterprise$150,000-$500,000+/year✓ (via SAP IPS)

All SCIM provisioning requires SAP Cloud Identity Services as a mandatory proxy, regardless of your SAP Commerce pricing tier.

What this means in practice

The SAP IPS requirement creates a multi-hop provisioning chain:

Your IdP → SAP Cloud Identity Services → SAP Commerce

This architecture introduces several operational challenges:

Dual configuration
You must configure provisioning in both your IdP and SAP Cloud Identity Services
Increased latency
User changes must propagate through two systems before reaching SAP Commerce
Troubleshooting complexity
Provisioning failures can occur at either hop, requiring investigation across multiple SAP systems
Schema limitations
You're constrained to SAP's standardized SCIM schema across their application suite

Additional constraints

SAP ecosystem lock-in
The IPS requirement ties you deeper into SAP's identity infrastructure, even if you only need SAP Commerce.
Enterprise licensing barrier
Quote-based pricing starts at $150K+ annually, calculated on order volume or GMV with 3-month minimum contracts.
No direct IdP integration
Unlike most SaaS applications, there's no direct Okta OIN app or native Azure AD connector for SAP Commerce.
Proxy dependency
Your provisioning reliability now depends on both SAP Commerce uptime AND SAP Cloud Identity Services availability.

Summary of challenges

  • SAP Commerce supports SCIM but only at Enterprise tier ($150,000-$500,000+/year)
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

SAP Commerce doesn't sell SCIM directly. It's bundled with Enterprise licensing and requires SAP Cloud Identity Services as an intermediary:

SCIM 2.0 provisioning via SAP Cloud Identity Services (SAP IPS)
SAML single sign-on integration
Enterprise-grade security controls
Advanced user management across SAP ecosystem
Multi-application identity governance
Professional support and SLA guarantees
Integration with SAP's broader cloud platform

The real cost isn't just SAP Commerce Enterprise ($150K-$500K+/year) - you also need SAP Cloud Identity Services licensing. SAP deliberately routes all identity management through their central platform, creating vendor lock-in across their entire ecosystem.

Stitchflow Insight

If you just need user provisioning for SAP Commerce, you're paying enterprise platform pricing for what should be basic identity automation. We estimate ~80% of the SAP enterprise bundle is irrelevant for teams that simply want to sync users from their existing IdP.

What IT admins are saying

Community sentiment on SAP Commerce's SCIM implementation reveals frustration with complexity and cost barriers. Common complaints:

  • Being locked into the entire SAP ecosystem for identity management
  • Requiring SAP Cloud Identity Services as an expensive intermediary layer
  • Enterprise-only pricing that starts at $150K+ annually just for basic provisioning
  • Complex multi-hop architecture that creates additional failure points

SAP forces you through their Cloud Identity Services for everything. It's like paying a toll booth to get to your own application.

Reddit r/sysadmin

The SAP Commerce licensing is insane. You're looking at $200K minimum just to get user provisioning working, when other platforms include it in their base plans.

Spiceworks Community

The recurring theme

SAP's approach treats SCIM as part of a broader enterprise lock-in strategy, forcing organizations to adopt multiple expensive SAP services just to automate basic user management.

The decision

Your SituationRecommendation
Need SCIM but not the $150K+ Enterprise tierUse Stitchflow: get provisioning without the massive platform upgrade
Already on Enterprise with SAP IPSUse native SCIM: you're paying for the full SAP ecosystem
Want direct IdP integration (bypass SAP IPS)Use Stitchflow: avoid the SAP proxy complexity
Small e-commerce team, low user turnoverManual may work: but watch for scaling issues
Evaluating SAP Commerce vs alternativesFactor SCIM costs: Stitchflow works with any e-commerce platform

The bottom line

SAP Commerce's SCIM requires both Enterprise licensing ($150K-500K+/year) and SAP Cloud Identity Services as a proxy layer. For organizations that need user provisioning without the full SAP enterprise commitment, Stitchflow provides direct integration at a fraction of the cost.

Make SAP Commerce workflows AI-native

SAP Commerce gates SCIM behind Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.

No Enterprise upgrade required
Less than a week, start to finish (~2 hours of your time)
We maintain the integration layer underneath
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Enterprise

Prerequisites

SSO must be configured first

Key limitations

  • SAP recommends using SAP Cloud Identity Services
  • Common SAP SCIM schema across apps
  • Multiple SAP integration points
  • Complex enterprise licensing

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → SAP Commerce → Provisioning

Required credentials

Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).

Configuration steps

Set Provisioning Mode = Automatic, configure SCIM connection.

Provisioning trigger

Entra provisions based on user/group assignments to the enterprise app.

Sync behavior

Entra provisioning runs on a scheduled cycle (typically every 40 minutes).

Microsoft Entra provisions to SAP Cloud Identity Services, which then provisions to SAP Commerce. SCIM 2.0 connector released Sept 2025. Requires SAP IPS as proxy.

SAP Commerce gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Unlock SCIM for
SAP Commerce

SAP Commerce gates SCIM behind Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.

See how it works
Admin Console
Directory
Applications
SAP Commerce logo
SAP Commerce
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

Magento logo

Magento

No SCIM

E-commerce Platform

ProvisioningNot Supported
Manual Cost$11,754/yr

Adobe Commerce (Magento) does not offer native SCIM provisioning on any plan. While the platform supports SSO through third-party marketplace extensions (like miniOrange SAML SP), these only handle authentication for storefront access. User provisioning must be handled manually through the admin panel or via custom API integrations. Even Adobe's Admin Console—used for managing Adobe product access—only supports SCIM with Azure AD and Google Workspace, leaving Okta and OneLogin users without automated provisioning options. This creates a significant operational gap for IT teams managing e-commerce operations. Without automated provisioning, onboarding new store managers, developers, and customer service staff requires manual account creation in both the identity provider and Magento. When employees leave or change roles, IT must remember to manually deprovision access across both systems. For enterprises running multiple Magento instances or managing seasonal staff fluctuations, this manual process becomes a compliance risk and administrative burden.

View full guide
Oracle Commerce logo

Oracle Commerce

No SCIM

E-commerce Platform

ProvisioningNot Supported
Manual Cost$11,754/yr

Oracle Commerce (CX Commerce) does not provide native SCIM provisioning. While the platform supports SAML 2.0 SSO through Oracle Identity Cloud Service (IDCS), SCIM functionality is only available indirectly through Oracle's broader IAM ecosystem, requiring IDCS as an intermediary layer. This architecture creates significant complexity for IT teams managing user provisioning, as you must configure and maintain Oracle's identity infrastructure even if you don't use other Oracle cloud services. The platform's enterprise-grade pricing (starting at $180,000-$300,000 annually) makes this limitation particularly problematic for organizations that need streamlined user lifecycle management. This creates a critical gap for e-commerce teams where Oracle Commerce handles the storefront but user provisioning remains a manual process. Without direct SCIM support, IT admins must manually create, update, and deactivate user accounts for merchants, administrators, and e-commerce team members. The reliance on IDCS as an intermediary adds another layer of complexity and potential failure points, making what should be automated provisioning workflows dependent on Oracle's broader cloud architecture.

View full guide
BigCommerce logo

BigCommerce

No SCIM

E-commerce Platform

ProvisioningNot Supported
Manual Cost$13,174/yr

BigCommerce, the e-commerce platform used by thousands of online retailers, does not offer native SCIM provisioning on any plan. While BigCommerce supports SSO through SAML 2.0 and OAuth protocols, organizations must rely on third-party solutions like miniOrange or LoginRadius to achieve automated user provisioning. This creates a significant gap for IT teams managing e-commerce operations, as they must integrate and maintain separate identity management tools just to automate basic user lifecycle tasks like onboarding store administrators, merchandisers, and customer service teams. The lack of native SCIM support becomes particularly problematic for growing e-commerce businesses that need rapid access changes across multiple storefronts or seasonal staff adjustments. Without automated provisioning, IT teams face manual user management overhead precisely when business velocity matters most. SSO alone doesn't solve this problem—it only handles authentication for users who already have accounts, leaving account creation, role assignments, and deprovisioning as manual processes that introduce security risks and operational delays.

View full guide