Summary and recommendation
Splunk supports SCIM, but only for automatic user deprovisioning—not the full lifecycle management most IT teams need. Available on Splunk Cloud 9.1+ (Enterprise tier required), the SCIM integration syncs user deletions from your IdP but won't create new accounts or update user attributes. This means IT teams still handle onboarding manually while only getting automated offboarding, and even that can take up to an hour to process.
This creates a significant operational gap. While SSO handles authentication, you're left manually provisioning every new security analyst, DevOps engineer, or IT administrator who needs Splunk access. Given Splunk's volume-based pricing (starting around $36,500/year for 10GB/day), manual account management becomes a costly bottleneck as teams scale. The compliance risk is equally concerning—without automated provisioning, there's no systematic way to ensure consistent role assignments or track who has access to sensitive security data.
The strategic alternative
Splunk gates SCIM behind Enterprise. Skip the Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | Yes |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Official docs |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ❌ | SSO only |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Splunk accounts manually. Here's what that costs:
The Splunk pricing problem
Splunk gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Splunk Cloud | $1,800/year (1GB/day) | Deprovisioning only | |
| Enterprise volumes | $50,000-$90,000/year (50GB/day) | Deprovisioning only |
Plan Structure
| Plan | Price | SCIM |
|---|---|---|
| Splunk Cloud | $1,800/year (1GB/day) | Deprovisioning only |
| Enterprise volumes | $50,000-$90,000/year (50GB/day) | Deprovisioning only |
Note: SCIM functionality is identical across all Splunk Cloud tiers—limited to user deletion sync from your IdP.
What this means in practice
Manual onboarding required: Every new user must be manually created in Splunk, even with SCIM enabled. The integration only automates the removal of users when they're deprovisioned from your IdP.
Attribute drift: User profile changes (role updates, team moves, permission changes) don't sync automatically. IT teams must manually update Splunk user attributes when changes occur in the source system.
Delayed deprovisioning: Delete operations can take up to 1 hour to process, creating a security window where terminated users may still have access.
Additional constraints
Summary of challenges
- Splunk supports SCIM but only at Enterprise tier (custom pricing)
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Splunk doesn't sell SCIM as a standalone feature. It's bundled with Splunk Cloud Enterprise pricing, which starts around $1,800/year for minimal usage (1GB/day):
The catch: Splunk's SCIM only handles user deprovisioning, not full lifecycle management. You can't create users or update attributes automatically—just remove access when someone leaves. Delete operations can take up to an hour to process.
Stitchflow Insight
If you're already using Splunk for SIEM/observability and need the enterprise features, the upgrade makes sense. But if you just want complete automated provisioning, you're paying enterprise prices for a half-implemented SCIM solution. We estimate ~80% of Enterprise features are irrelevant for teams that only need full user lifecycle automation.
What IT admins are saying
Community sentiment on Splunk's SCIM implementation reveals significant frustration with its limited scope and complex setup. Common complaints:
- SCIM only handles deprovisioning, not full user lifecycle management
- Setup process is confusing and not straightforward in Okta
- Delete operations can take up to an hour to process
- May require creating entirely new SAML apps just to enable SCIM support
SCIM setup not straightforward
Confusing Okta UI for SCIM setup
The recurring theme
Splunk's SCIM feels like an afterthought - it only handles the bare minimum (user deletion) while creating unnecessary complexity for what should be basic identity automation.
The decision
| Your Situation | Recommendation |
|---|---|
| Need full user lifecycle management | Use Stitchflow: Splunk's SCIM only handles deprovisioning |
| Want automated provisioning without Enterprise costs | Use Stitchflow: avoid the $50K-90K/year Enterprise requirement |
| Already on Splunk Cloud Enterprise | Use native SCIM: you're paying for it, though it's limited |
| Using Azure AD or other non-Okta IdPs | Use Stitchflow: native SCIM only documented for Okta |
| Small security team, infrequent user changes | Manual may work: but monitor for orphaned accounts |
The bottom line
Splunk gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.
Make Splunk workflows AI-native
Splunk gates SCIM behind Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
SSO must be configured first
Key limitations
- SCIM primarily for deprovisioning only
- Delete operations can take up to 1 hour
- Some Okta apps may not support SCIM
- Requires SHA-256 signature
- May need new SAML app for SCIM support
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Prerequisite
SSO must be configured before enabling SCIM.
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
SCIM integration primarily for automatic user deprovisioning. Delete operations can take up to 1 hour. May require new SAML app for SCIM support.
Splunk gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.
Unlock SCIM for
Splunk
Splunk gates SCIM behind Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.
See how it works
