Stripe SCIM guide

KnowBe4 supports SCIM across all plans (Silver through Diamond), enabling automatic user provisioning from your IdP to their KSAT console. However, SCIM is strictly one-way sync only—changes made within KnowBe4 never sync back to your identity provider. This creates a problematic data flow where user attributes, group memberships, or account status changes made in KnowBe4 remain isolated, forcing IT teams to maintain dual sources of truth. For security awareness training, this limitation is particularly problematic because compliance tracking requires accurate, centralized user data. When employees complete training, change departments, or have their access modified in KnowBe4, those updates don't flow back to your IdP, creating gaps in your identity governance. SSO alone doesn't solve this—it handles authentication but leaves the provisioning gap that compliance audits will catch.

LastPass supports SCIM provisioning starting at the Business tier ($7/user/month), with integration support for all major identity providers including Okta, Entra ID, Google Workspace, and OneLogin. However, LastPass SCIM has critical limitations around deprovisioning: when users are removed, their vault access isn't immediately revoked, and shared folder permissions become complex to manage at scale. This creates a significant security gap for IT teams. Password vaults contain the most sensitive credentials in your organization—API keys, service accounts, privileged access passwords. When employees leave or change roles, their access to these credentials must be revoked immediately, not left accessible while IT manually cleans up vault permissions. SSO alone doesn't solve this because it only controls login authentication, not ongoing vault access or shared resource permissions.

1Password supports SCIM provisioning on its Business plan ($7.99/user/month), but requires deploying and managing the 1Password SCIM Bridge on your own infrastructure. This self-hosted approach means you're responsible for maintaining servers, handling updates, and troubleshooting connectivity issues between your identity provider and 1Password's systems. The SCIM Bridge also operates separately from SSO (which uses OIDC only), requiring you to configure and maintain two distinct integrations. This architecture creates operational overhead that many IT teams don't want to manage. Unlike cloud-native SCIM implementations, you're essentially running 1Password's provisioning infrastructure for them. When the SCIM Bridge goes down, provisioning stops working. When 1Password updates their API, you need to update your Bridge deployment. For teams that just want automated user lifecycle management, this becomes an ongoing maintenance burden.