Stitchflow
Slack logo

Slack SCIM guide

Native SCIM

How to automate Slack user provisioning, and what it actually costs

Native SCIM requires Enterprise Grid plan

Summary and recommendation

Slack supports SCIM provisioning (the protocol that lets your identity provider automatically create, update, and remove user accounts). But Slack restricts full SCIM functionality to Enterprise Grid—its top-tier plan that costs ~$230/user/year and requires custom pricing negotiations. Teams on Business+ ($180/user/year) get SSO but no automated provisioning, creating a manual management burden that defeats the purpose of centralized identity management.

The pricing jump from Business+ to Enterprise Grid represents a 28% increase plus the complexity of Grid's multi-workspace architecture. For a 200-person team, that's an additional $10,000/year just to unlock automated user lifecycle management. Once you upgrade to Enterprise Grid, Slack's policy is permanent—no downgrades allowed, ever—making this a high-stakes decision that locks you into their most expensive tier indefinitely.

The strategic alternative

Stitchflow provides SCIM-level provisioning through resilient browser automation for Slack without requiring Enterprise Grid. Works with Business+ plans and any identity provider. Flat pricing under $5K/year, regardless of team size, with no permanent commitments.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredEnterprise
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDGallery app with SCIM
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Slack accounts manually. Here's what that costs:

Source: Stitchflow customers using Slack, normalized to 500 employees:
Orphaned accounts (ex-employees with access)6
Unused licenses7
IT hours spent on manual management/year119 hours
Unused license cost/year$667
IT labor cost/year$7,128
Cost of compliance misses/year$1,523
Total annual financial impact$9,318

The Slack pricing problem

Slack gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Plan Structure (Per User, Billed Annually)

PlanPriceSSOSCIM
Pro$7.25/user/mo
Business+$15/user/mo
Enterprise Grid~$20/user/mo

Note: Enterprise Grid pricing is custom and requires direct negotiation with Slack sales. The ~$240/user/year figure is typical but varies based on commitment and organization size.

What this means in practice

Using typical Enterprise Grid pricing versus Business+ for SCIM access:

Team SizeAnnual Upgrade CostMonthly Increase
100 users+$6,000/year+$500/month
250 users+$15,000/year+$1,250/month
500 users+$30,000/year+$2,500/month

Calculation: ($20 - $15) × users × 12 months (using conservative Grid estimate)

Additional constraints

Permanent lock-in
Once you upgrade to Enterprise Grid, Slack does not allow downgrades—ever. This makes Grid a one-way decision regardless of future needs.
Complex architecture
Enterprise Grid introduces a multi-workspace structure that many organizations don't need but must accept for SCIM access.
Custom pricing negotiation
No transparent pricing means lengthy sales cycles and unpredictable costs, especially for mid-market companies.
All-or-nothing upgrade
You can't selectively enable SCIM for specific teams—the entire organization must move to Grid.
Bundled complexity
SCIM comes with cross-workspace channels, DLP, and governance features that add management overhead.

Summary of challenges

  • Slack supports SCIM but only at Enterprise tier ($45/user/mo (Enterprise+, custom))
  • Lower tiers may include SSO but exclude SCIM provisioning
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

Slack doesn't sell SCIM separately. It's exclusively bundled with Enterprise Grid, which transforms your entire Slack experience:

SCIM automated provisioning (full cross-workspace support)
SAML single sign-on (SSO) across all workspaces
Multi-workspace architecture and cross-workspace channels
Data Loss Prevention (DLP) and eDiscovery
Enterprise compliance tools and audit logs
Shared channels with external organizations
Advanced administrative controls and governance
Dedicated customer success management

Enterprise Grid fundamentally changes how Slack works—you're not just getting SCIM, you're getting an entirely different product architecture. Most organizations find ~80% of Grid's complexity and features unnecessary if they just need automated user provisioning for their existing workspace setup.

The real challenge: once you upgrade to Enterprise Grid, Slack never allows downgrades. You're permanently locked into the Grid architecture and its associated costs, even if your needs change.

What IT admins are saying

Community sentiment on Slack's SCIM requirements is strongly negative, with IT admins frustrated by the Enterprise Grid lock-in model. Common complaints:

  • Being forced into Enterprise Grid pricing just for SCIM provisioning
  • The massive price jump from Business+ ($15/user/month) to Grid (~$20/user/month)
  • The permanent commitment - once you upgrade to Grid, you can never downgrade
  • Complex multi-workspace architecture that many organizations don't need

The Enterprise Grid lock-in is brutal - once you're on it for SCIM, you're stuck forever. No going back to simpler plans.

Reddit r/sysadmin

We just need automated user provisioning, not a complex multi-workspace setup. But Slack forces you into their most expensive tier.

Spiceworks Community

The recurring theme

Slack uses SCIM as leverage to force organizations into their highest-tier plan with permanent commitment, creating vendor lock-in that IT teams deeply resent.

The decision

Your SituationRecommendation
On Pro or Business+, need SCIMUse Stitchflow: avoid the Enterprise Grid tier jump and permanent lock-in
Already on Enterprise GridUse native SCIM: you're paying $19-20/user/month for it
Small team (<50 users) with low turnoverManual may work short-term: but plan for growth challenges
Need Grid features beyond SCIMEvaluate Enterprise Grid: SCIM comes bundled with advanced features
Want SCIM flexibility without permanent commitmentUse Stitchflow: no irreversible tier upgrades required

The bottom line

Slack's Enterprise Grid requirement creates a massive cost barrier—jumping from $15/user/month (Business+) to $19-20/user/month with no downgrade option ever. For teams that need SCIM without the Grid commitment and complexity, Stitchflow delivers the automation at a fraction of the cost.

Automate Slack without the tier upgrade

Stitchflow delivers SCIM-level provisioning through resilient browser automation, backed by 24/7 human in the loop for Slack at <$5K/year, flat, regardless of team size.

Works alongside or instead of native SCIM
Syncs with your existing IdP (Okta, Entra ID, Google Workspace)
Automates onboarding and offboarding
SOC 2 Type II certified
24/7 human-in-the-loop monitoring
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Enterprise

Prerequisites

SSO must be configured first

Key limitations

  • Full SCIM only on Enterprise Grid - not Business+
  • Cannot downgrade from Enterprise Grid once upgraded
  • Grid requires significant commitment (custom pricing/negotiation)

Configuration for Okta

Integration type

Okta Integration Network (OIN) app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Okta Admin Console → Applications → Slack → Provisioning

Required credentials

SCIM endpoint URL and bearer token (generated in app admin console).

Configuration steps

Enable Create Users, Update User Attributes, and Deactivate Users.

Provisioning trigger

Okta provisions based on app assignments (users or groups).

Enterprise required for SCIM

Native SCIM is available on Enterprise. Use Stitchflow if you need provisioning without the tier upgrade.

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → Slack → Provisioning

Required credentials

Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).

Configuration steps

Set Provisioning Mode = Automatic, configure SCIM connection.

Provisioning trigger

Entra provisions based on user/group assignments to the enterprise app.

Sync behavior

Entra provisioning runs on a scheduled cycle (typically every 40 minutes).

Enterprise required for SCIM

Native SCIM is available on Enterprise. Use Stitchflow if you need provisioning without the tier upgrade.

Unlock SCIM for
Slack

Slack gates automation behind Enterprise Grid plan. Stitchflow delivers the same SCIM outcomes for a flat fee, saving you 176%.

See how it works
Admin Console
Directory
Applications
Slack logo
Slack
via Stitchflow

Last updated: 2026-01-02

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

LastPass logo

LastPass

SCIM Tax

Password Management / Security

SCIM Tax+75%
Manual Cost$9,705/yr

LastPass supports SCIM provisioning starting at the Business tier ($7/user/month), with integration support for all major identity providers including Okta, Entra ID, Google Workspace, and OneLogin. However, LastPass SCIM has critical limitations around deprovisioning: when users are removed, their vault access isn't immediately revoked, and shared folder permissions become complex to manage at scale. This creates a significant security gap for IT teams. Password vaults contain the most sensitive credentials in your organization—API keys, service accounts, privileged access passwords. When employees leave or change roles, their access to these credentials must be revoked immediately, not left accessible while IT manually cleans up vault permissions. SSO alone doesn't solve this because it only controls login authentication, not ongoing vault access or shared resource permissions.

View full guide
Zoom logo

Zoom

SCIM Tax
SCIM Tax+22%
Manual Cost$8,844/yr

Zoom supports native SCIM 2.0 provisioning, but only on Business plans and above ($18.33/user/month minimum). While this covers most enterprise use cases, Zoom's SCIM implementation has specific requirements that can create friction: your email domain must be pre-associated with your Zoom account, users need existing Zoom accounts with SSO login types for proper provisioning, and recent OAuth2 migration requirements mean existing Bearer auth integrations need reconfiguration. For smaller teams on Pro plans ($14.99/user/month), upgrading to Business just for SCIM means a 23% price increase purely for provisioning automation. For a 50-person team, that's $1,020/year in additional licensing costs. The domain association requirement can also delay initial deployments, especially for organizations with complex domain structures.

View full guide
Linear logo

Linear

SCIM Tax
SCIM StatusIncluded
Manual Cost$8,330/yr

Linear supports SCIM 2.0 for automated user provisioning, but only on its Enterprise plan with custom pricing (typically $192-240/user/year). The company requires SAML SSO to be enabled before SCIM can be configured, meaning you can't use automated provisioning without also implementing single sign-on. For teams currently on Business ($9.60/user/month annually), upgrading to Enterprise represents a 20x price increase just to unlock basic provisioning automation. This creates a significant gap for growing teams that need automated user lifecycle management but aren't ready for enterprise-level pricing. While Linear offers JIT provisioning through SAML, this only creates accounts when users first log in—it doesn't handle deprovisioning when employees leave or role changes that require immediate access removal. For compliance-focused organizations, waiting for users to self-provision on first login isn't acceptable.

View full guide