Tableau SCIM guide

Redash, the open-source data visualization platform, does not support SCIM provisioning. Since Databricks discontinued the cloud service in November 2021, Redash is now only available as a self-hosted solution with SAML 2.0 SSO and JIT (Just-In-Time) provisioning. Users are automatically created on their first SAML login, with group membership controlled through the RedashGroups SAML attribute. While this works for small teams, it creates significant operational overhead for larger organizations that need predictable user lifecycle management. The JIT-only approach means IT teams have no visibility into who will have access until users actually log in, making it impossible to audit access rights or ensure proper deprovisioning when employees leave. For organizations using Redash for sensitive business intelligence and data visualization, this creates compliance gaps and security risks. Self-hosting requirements add additional complexity, as teams must manage both the application infrastructure and user provisioning workflows manually.

Amplitude supports SCIM provisioning, but only on Growth plans (starting around $36K/year) or Enterprise plans with custom pricing. While Amplitude's SCIM implementation covers the core functionality—creating, updating, and deactivating users—it requires SCIM to be specifically enabled for your organization, and regenerating the SCIM key immediately invalidates existing integrations without warning. For product teams on Plus plans ($49/month), upgrading to Growth just to unlock SCIM means jumping from under $600/year to $36,000+/year—a 60x increase. That's often more than the entire analytics budget for smaller product teams. The gap becomes particularly problematic for cross-functional product teams where analysts, PMs, and engineers need varying levels of access to user behavior data, but manual provisioning creates security risks around sensitive analytics permissions.

Apache Superset, the open-source business intelligence platform, provides no native SCIM provisioning capabilities. While Superset supports various authentication methods including OAuth2, OIDC, and LDAP, SAML SSO requires custom development through a CustomSsoSecurityManager class implementation. Even with SSO configured, user provisioning must be handled manually or through Superset's beta User API, which isn't enabled by default and requires additional configuration in superset_config.py. This creates a significant operational burden for IT teams managing data analysts, engineers, and business users who need access to dashboards and datasets. The lack of automated provisioning means manual account creation for every new hire, plus ongoing management of complex dashboard permissions and row-level security settings. For organizations running self-hosted Superset instances, this translates to custom development work just to achieve basic enterprise SSO integration, let alone automated user lifecycle management.