Stitchflow
Toggl logo

Toggl SCIM guide

Connector Only

How to automate Toggl user provisioning, and what it actually costs

Summary and recommendation

Toggl Track, the popular time tracking platform, does not support native SCIM provisioning on any plan. While Toggl offers SAML 2.0 SSO integration on Premium and Enterprise plans with just-in-time (JIT) provisioning, this creates a significant gap for IT teams managing user lifecycles. Users are automatically created when they first log in through SSO, but there's no automated way to deprovision users, update attributes, or manage group memberships through your identity provider. This leaves IT teams manually managing user access in Toggl's interface, defeating the purpose of automated provisioning workflows.

The lack of true SCIM support means that when employees leave or change roles, their Toggl access must be manually revoked—creating both security risks and administrative overhead. For organizations tracking billable hours or managing client projects through Toggl, this manual process becomes particularly problematic since deprovisioning delays can lead to continued access to sensitive time tracking data and client information.

The strategic alternative

Toggl has no native SCIM. Automate offboarding, user access reviews, and license workflows across every app, including the ones without APIs. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?No
SCIM tier requiredN/A
SSO required first?No
SSO available?Yes
SSO protocolSAML 2.0
DocumentationNot available

Supported identity providers

IdPSSOProvisioningNotes
OktaVia APIOkta OIN integration with provisioning capabilities including group import and schema discovery.
Microsoft Entra IDAzure AD SSO supported via SAML 2.0. No native Entra provisioning documented.
Google WorkspaceSSO only, no provisioning
OneLoginSSO only

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages Toggl accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The Toggl pricing problem

Toggl gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
Starter$9/user/mo annual
Premium$18/user/mo annual
EnterpriseCustom pricing

Pricing structure

PlanPriceSSOSCIM
Starter$9/user/mo annual
Premium$18/user/mo annual
EnterpriseCustom pricing

What this means in practice

Without SCIM, IT teams must rely on Toggl's JIT provisioning, which creates accounts only when users first log in through SSO. This creates several operational challenges:

No proactive user creation
Users don't exist in Toggl until they attempt their first login
No group/role mapping
JIT provisioning creates basic accounts without team assignments or role configurations
Manual cleanup required
Departing employees' accounts remain active since there's no automated deprovisioning
Limited attribute syncing
Only basic profile information transfers during JIT creation

For a 100-user organization, this means upgrading from Starter ($900/month) to Premium ($1,800/month) just to enable basic SSO functionality - a $10,800 annual increase with no automated provisioning capabilities.

Additional constraints

Manual team management
Administrators must manually assign users to projects and workspaces after JIT creation
No role automation
User permissions and roles require manual configuration in Toggl's interface
Okta integration limitations
While Okta's OIN lists provisioning support, this appears to be API-based user creation rather than true SCIM
Audit trail gaps
No centralized visibility into user lifecycle events without manual tracking

Summary of challenges

  • Toggl does not provide native SCIM at any price tier
  • Organizations must rely on third-party tools or manual provisioning
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What Toggl actually offers for identity

SAML SSO (Premium/Enterprise)

Toggl Track includes SAML 2.0 single sign-on on Premium ($20/user/month) and Enterprise plans:

SettingDetails
ProtocolSAML 2.0
Supported IdPsOkta, Azure AD, Google Workspace, OneLogin, generic SAML
JIT Provisioning✓ Yes - auto-creates users on first login
SP-initiated✓ Yes
IdP-initiated✓ Yes

Okta Integration (via OIN)

The official Okta Integration Network listing shows provisioning capabilities:

FeatureSupported?
SAML SSO✓ Yes
Create users✓ Yes (via API)
Update users✓ Yes
Deactivate users✓ Yes
Group push✓ Yes
SCIM protocol❌ No

The catch: While Okta can provision users to Toggl, this uses Okta's proprietary API connector method, not standard SCIM. Other identity providers (Azure AD, Google Workspace, OneLogin) are limited to JIT provisioning through SSO.

What's missing

No native SCIM support
Toggl relies on SSO just-in-time provisioning or Okta's custom API integration
IdP lock-in
Only Okta gets full provisioning capabilities; other IdPs must rely on JIT
Limited deprovisioning
Users created via JIT can't be automatically deactivated when removed from your IdP
No group mapping
Teams and project assignments require manual configuration

For organizations using Azure AD, Google Workspace, or OneLogin, you're stuck with basic JIT provisioning that only creates accounts - no ongoing lifecycle management.

What IT admins are saying

Toggl's limited provisioning options frustrate IT teams managing larger organizations:

  • Manual user creation required despite Premium SSO pricing
  • No native SCIM means relying on basic JIT provisioning
  • Users can't be pre-provisioned or deprovisioned automatically
  • Group membership and role assignments must be handled manually

SAML 2.0 SSO on Premium/Enterprise. Auto-create users on first login. No native SCIM provisioning.

Toggl Support Documentation

Users are automatically created in your Toggl Track workspace when they first log in using SSO.

Toggl SAML Configuration Guide

The recurring theme

Even after paying for Premium ($20/user/month), IT teams get basic JIT provisioning that only creates users on first login. There's no way to pre-provision users, manage departures automatically, or sync group memberships - everything beyond initial user creation requires manual intervention.

The decision

Your SituationRecommendation
Small team (<10 users) on Starter planManual management is acceptable
Premium plan with stable teamUse SSO JIT provisioning for authentication only
Growing team with frequent onboardingUse Stitchflow: automation essential for scaling
Enterprise with compliance requirementsUse Stitchflow: automation essential for audit trail
Multi-department time tracking rolloutUse Stitchflow: automation strongly recommended

The bottom line

Toggl Track offers solid time tracking capabilities but relies entirely on SSO auto-provisioning instead of proper SCIM. While JIT provisioning works for authentication, it provides no deprovisioning automation or group management. For organizations that need reliable user lifecycle management, Stitchflow delivers the automation Toggl Track can't provide natively.

Make Toggl workflows AI-native

Toggl has no native SCIM. We build complete offboarding, user access reviews, and license workflows across every app, including the ones without APIs.

Covers apps without native SCIM, including the ones without APIs
Less than a week, start to finish (~2 hours of your time)
Built with your team; extend to anything else in the company
Book a Demo

Technical specifications

SCIM Version

Not specified

Supported Operations

Not specified

Supported Attributes

No native SCIM provisioningUses SSO auto-create instead of SCIMPremium plan required for SSO

Plan requirement

Not specified

Prerequisites

Not specified

Key limitations

  • No native SCIM provisioning
  • Uses SSO auto-create instead of SCIM
  • Premium plan required for SSO

Documentation not available.

Configuration for Okta

Integration type

Okta Integration Network (OIN) app

Where to enable

Okta Admin Console → Applications → Toggl → Sign On

Okta OIN integration with provisioning capabilities including group import and schema discovery.

Use Stitchflow for automated provisioning.

Unlock SCIM for
Toggl

Toggl has no native SCIM. We still automate end-to-end workflows across every app, including the ones without APIs.

See how it works
Admin Console
Directory
Applications
Toggl logo
Toggl
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

6sense logo

6sense

No SCIM

B2B Revenue Intelligence / ABM

ProvisioningNot Supported
Manual Cost$11,754/yr

6sense, the B2B revenue intelligence platform, has paused SCIM provisioning for new customers until Q4 2026. While existing customers with SCIM enabled can continue using it, new implementations are limited to JIT (Just-In-Time) provisioning through SAML SSO. This creates a significant gap for IT teams managing revenue intelligence access, as JIT only creates users on first login and provides minimal attribute mapping (email, first name, last name only). For an enterprise platform with typical pricing of $55,000-$130,000 annually, the absence of automated user lifecycle management is a substantial limitation. The lack of SCIM until Q4 2026 forces IT teams into manual provisioning workflows for a platform handling sensitive revenue data. While SAML SSO handles authentication, it doesn't address user lifecycle events like role changes, department transfers, or offboarding. This creates compliance risks in revenue teams where access to prospect data and sales intelligence must be tightly controlled. The nearly two-year wait for SCIM restoration means organizations implementing 6sense today face manual user management for the foreseeable future.

View full guide
Aha! logo

Aha!

No SCIM

Product Management / Roadmapping

ProvisioningNot Supported
Manual Cost$11,754/yr

Aha! Roadmaps, the product roadmapping platform, does not support SCIM provisioning on any plan. While Aha! offers SAML 2.0 SSO integration with identity providers like Okta, Entra ID, and OneLogin, this only handles authentication through JIT (Just-In-Time) provisioning. The critical limitation: JIT provisioning creates user accounts with no default role or access permissions, requiring administrators to manually configure access for each user after they first sign in. For product teams managing strategic roadmaps and stakeholder access, this creates significant operational overhead. Since product roadmaps contain sensitive strategic information and stakeholder access typically varies by product area, IT administrators must manually assign appropriate roles and workspace permissions after each user is provisioned. There's no automatic deprovisioning when users leave the organization, creating potential security gaps. This manual process becomes particularly problematic for larger product organizations where dozens of stakeholders across different business units need carefully managed access to specific roadmaps.

View full guide
Appcues logo

Appcues

No SCIM

Product Adoption / User Onboarding

ProvisioningNot Supported
Manual Cost$11,754/yr

Appcues, the product adoption platform used by product managers and growth teams, explicitly does not support SCIM provisioning on any plan—not even Enterprise. While Appcues offers SAML 2.0 SSO integration starting at the Enterprise tier with just-in-time (JIT) provisioning, this only creates users during first login and provides no automated deprovisioning capabilities. For product teams where access needs change frequently as people move between projects or leave the company, this creates a significant security gap. The lack of SCIM means IT teams must manually manage user lifecycle for Appcues accounts, even though the platform handles sensitive product analytics and user flow data. When employees leave or change roles, their Appcues access remains active until manually revoked—a compliance risk that's particularly problematic given Appcues' role in tracking user behavior and product metrics. With MAU-based pricing starting at $300/month and scaling significantly with usage, paying for orphaned accounts also creates unnecessary cost bloat.

View full guide