Summary and recommendation
Spendesk, the spend management platform, does not support SCIM provisioning on any plan. While Spendesk offers SAML 2.0 SSO integration with identity providers like Okta, Azure AD, and OneLogin, this only handles authentication—not user lifecycle management. Users must be manually invited to Spendesk before they can authenticate via SSO, creating a significant provisioning gap that requires ongoing manual intervention from IT teams.
This creates a problematic workflow where IT admins must maintain dual processes: managing users in their identity provider AND separately inviting each user to Spendesk. For organizations with frequent employee onboarding, offboarding, or role changes, this manual overhead becomes particularly burdensome. The lack of role and team synchronization means that user permissions within Spendesk must also be managed separately from your IdP's group structure, increasing the risk of access creep and compliance violations.
The strategic alternative
Spendesk has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.
Quick SCIM facts
| SCIM available? | No |
| SCIM tier required | N/A |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ❌ | SAML SSO only. No SCIM/provisioning support - users must be invited to Spendesk before they can authenticate via Okta. |
| Microsoft Entra ID | ✓ | ❌ | SAML SSO supported. No SCIM provisioning. |
| Google Workspace | Via third-party | ❌ | No native support |
| OneLogin | Via third-party | ❌ | No native support |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Spendesk accounts manually. Here's what that costs:
The Spendesk pricing problem
Spendesk gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Custom | ~$7,600/year |
Pricing and provisioning features
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Custom | ~$7,600/year |
Key limitation: Users must be manually invited to Spendesk before SSO login works. There's no automated user provisioning or role synchronization.
What this means in practice
Without SCIM, your Spendesk user management becomes a two-step manual process:
1. Manual invitation required: IT must invite each user to Spendesk through their admin panel 2. SSO authentication: Only after invitation can users log in through Okta/Entra/etc.
For a 200-person company, this means manually inviting 200 users before anyone can use SSO. New hires require manual intervention every time.
Additional constraints
Summary of challenges
- Spendesk does not provide native SCIM at any price tier
- Organizations must rely on third-party tools or manual provisioning
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Spendesk actually offers for identity
SAML SSO (paid add-on or included in certain plans)
Spendesk supports SAML 2.0 integration with major identity providers:
| Setting | Details |
|---|---|
| Protocol | SAML 2.0 |
| Supported IdPs | Okta, OneLogin, Azure AD, generic SAML providers |
| Configuration | SP-initiated and IdP-initiated flows |
| Enforcement | Can enforce SSO-only login |
| User requirement | Users must be invited to Spendesk before SSO login |
Critical limitation: Spendesk has no SCIM provisioning whatsoever. You must manually invite each user to Spendesk before they can authenticate via SSO. There's no Just-in-Time (JIT) provisioning either.
What's missing entirely
| Feature | Supported? |
|---|---|
| SCIM provisioning | ❌ No |
| Create users automatically | ❌ No |
| Update user attributes | ❌ No |
| Deactivate users | ❌ No |
| Group/role sync | ❌ No |
| JIT provisioning | ❌ No |
The real operational burden
Without automated provisioning, your IT team must:
For a spend management platform that should integrate seamlessly with your corporate directory, this manual overhead defeats the purpose of having centralized identity management.
What IT admins are saying
Spendesk's lack of SCIM provisioning creates ongoing manual work for IT teams managing spend management access:
- No automated user provisioning - every employee must be manually invited to Spendesk
- Users must exist in Spendesk before SSO login works, creating a two-step onboarding process
- Role and team assignments can't sync from identity providers
- Manual cleanup required when employees leave or change departments
Users must be invited to Spendesk before they can use SSO to log in.
SAML SSO with Okta, OneLogin, Azure. Can enforce SSO-only login. NO SCIM - users must be invited to Spendesk first.
The recurring theme
Despite having SAML SSO, Spendesk requires IT teams to maintain a separate user management workflow. Every new hire means manually sending Spendesk invitations before SSO authentication works, and departing employees require manual cleanup in both systems.
The decision
| Your Situation | Recommendation |
|---|---|
| Small finance team (<20 users) | Manual user invitations are manageable |
| Stable team with infrequent user changes | Use manual process with SSO for authentication |
| Large organization (100+ employees using cards) | Use Stitchflow: manual invitations become unmanageable |
| High employee turnover or seasonal workers | Use Stitchflow: automation essential for onboarding/offboarding |
| Multi-department rollout with compliance needs | Use Stitchflow: audit trail and role sync critical |
The bottom line
Spendesk offers robust spend management features but forces you to manually invite every user before they can access the platform—even with SSO enabled. For organizations that need seamless user provisioning without the administrative burden, Stitchflow eliminates the invitation bottleneck entirely.
Make Spendesk workflows AI-native
Spendesk has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.
Technical specifications
SCIM Version
Not specifiedSupported Operations
Not specifiedSupported Attributes
Plan requirement
Not specifiedPrerequisites
Not specifiedKey limitations
- No SCIM provisioning
- Users must be invited before SSO login
- Roles/teams not synced with IdP
- SSO is paid add-on or included in certain plans
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app
Where to enable
Docs
SAML SSO only. No SCIM/provisioning support - users must be invited to Spendesk before they can authenticate via Okta.
Use Stitchflow for automated provisioning.
Unlock SCIM for
Spendesk
Spendesk has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.
See how it works


