Summary and recommendation
Toggl Track, the popular time tracking platform, does not support native SCIM provisioning on any plan. While Toggl offers SAML 2.0 SSO integration on Premium and Enterprise plans with just-in-time (JIT) provisioning, this creates a significant gap for IT teams managing user lifecycles. Users are automatically created when they first log in through SSO, but there's no automated way to deprovision users, update attributes, or manage group memberships through your identity provider. This leaves IT teams manually managing user access in Toggl's interface, defeating the purpose of automated provisioning workflows.
The lack of true SCIM support means that when employees leave or change roles, their Toggl access must be manually revoked—creating both security risks and administrative overhead. For organizations tracking billable hours or managing client projects through Toggl, this manual process becomes particularly problematic since deprovisioning delays can lead to continued access to sensitive time tracking data and client information.
The strategic alternative
Toggl has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.
Quick SCIM facts
| SCIM available? | No |
| SCIM tier required | N/A |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | Provisioning | Notes |
|---|---|---|---|
| Okta | ✓ | Via API | Okta OIN integration with provisioning capabilities including group import and schema discovery. |
| Microsoft Entra ID | ✓ | ❌ | Azure AD SSO supported via SAML 2.0. No native Entra provisioning documented. |
| Google Workspace | ✓ | ❌ | SSO only, no provisioning |
| OneLogin | ✓ | ❌ | SSO only |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Toggl accounts manually. Here's what that costs:
The Toggl pricing problem
Toggl gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Starter | $9/user/mo annual | ||
| Premium | $18/user/mo annual | ||
| Enterprise | Custom pricing |
Pricing structure
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Starter | $9/user/mo annual | ||
| Premium | $18/user/mo annual | ||
| Enterprise | Custom pricing |
What this means in practice
Without SCIM, IT teams must rely on Toggl's JIT provisioning, which creates accounts only when users first log in through SSO. This creates several operational challenges:
For a 100-user organization, this means upgrading from Starter ($900/month) to Premium ($1,800/month) just to enable basic SSO functionality - a $10,800 annual increase with no automated provisioning capabilities.
Additional constraints
Summary of challenges
- Toggl does not provide native SCIM at any price tier
- Organizations must rely on third-party tools or manual provisioning
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What Toggl actually offers for identity
SAML SSO (Premium/Enterprise)
Toggl Track includes SAML 2.0 single sign-on on Premium ($20/user/month) and Enterprise plans:
| Setting | Details |
|---|---|
| Protocol | SAML 2.0 |
| Supported IdPs | Okta, Azure AD, Google Workspace, OneLogin, generic SAML |
| JIT Provisioning | ✓ Yes - auto-creates users on first login |
| SP-initiated | ✓ Yes |
| IdP-initiated | ✓ Yes |
Okta Integration (via OIN)
The official Okta Integration Network listing shows provisioning capabilities:
| Feature | Supported? |
|---|---|
| SAML SSO | ✓ Yes |
| Create users | ✓ Yes (via API) |
| Update users | ✓ Yes |
| Deactivate users | ✓ Yes |
| Group push | ✓ Yes |
| SCIM protocol | ❌ No |
The catch: While Okta can provision users to Toggl, this uses Okta's proprietary API connector method, not standard SCIM. Other identity providers (Azure AD, Google Workspace, OneLogin) are limited to JIT provisioning through SSO.
What's missing
For organizations using Azure AD, Google Workspace, or OneLogin, you're stuck with basic JIT provisioning that only creates accounts - no ongoing lifecycle management.
What IT admins are saying
Toggl's limited provisioning options frustrate IT teams managing larger organizations:
- Manual user creation required despite Premium SSO pricing
- No native SCIM means relying on basic JIT provisioning
- Users can't be pre-provisioned or deprovisioned automatically
- Group membership and role assignments must be handled manually
SAML 2.0 SSO on Premium/Enterprise. Auto-create users on first login. No native SCIM provisioning.
Users are automatically created in your Toggl Track workspace when they first log in using SSO.
The recurring theme
Even after paying for Premium ($20/user/month), IT teams get basic JIT provisioning that only creates users on first login. There's no way to pre-provision users, manage departures automatically, or sync group memberships - everything beyond initial user creation requires manual intervention.
The decision
| Your Situation | Recommendation |
|---|---|
| Small team (<10 users) on Starter plan | Manual management is acceptable |
| Premium plan with stable team | Use SSO JIT provisioning for authentication only |
| Growing team with frequent onboarding | Use Stitchflow: automation essential for scaling |
| Enterprise with compliance requirements | Use Stitchflow: automation essential for audit trail |
| Multi-department time tracking rollout | Use Stitchflow: automation strongly recommended |
The bottom line
Toggl Track offers solid time tracking capabilities but relies entirely on SSO auto-provisioning instead of proper SCIM. While JIT provisioning works for authentication, it provides no deprovisioning automation or group management. For organizations that need reliable user lifecycle management, Stitchflow delivers the automation Toggl Track can't provide natively.
Make Toggl workflows AI-native
Toggl has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.
Technical specifications
SCIM Version
Not specifiedSupported Operations
Not specifiedSupported Attributes
Plan requirement
Not specifiedPrerequisites
Not specifiedKey limitations
- No native SCIM provisioning
- Uses SSO auto-create instead of SCIM
- Premium plan required for SSO
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app
Where to enable
Docs
Okta OIN integration with provisioning capabilities including group import and schema discovery.
Use Stitchflow for automated provisioning.
Unlock SCIM for
Toggl
Toggl has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.
See how it works


