Summary and recommendation
Veeam supports native SCIM 2.0 provisioning, but only on the Premium tier (~$450/workload VUL). For teams on Standard or Advanced plans, there's no automated user provisioning—IT must manually create external user/group accounts before SSO can work. This creates a significant gap: while SSO authentication works across all Veeam products (Backup & Replication, Service Provider Console, Data Cloud), the provisioning piece requires a costly tier upgrade.
The Premium requirement creates a real operational burden. Without automated provisioning, every new hire, role change, or departure requires manual intervention in Veeam's console to create or update external user accounts. SSO alone doesn't solve this—users still need their accounts provisioned first. For organizations with frequent personnel changes or strict compliance requirements, this manual process becomes a security risk and administrative bottleneck.
The strategic alternative
Veeam gates SCIM behind Enterprise. Skip the Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ❌ | SSO only |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Veeam accounts manually. Here's what that costs:
The Veeam pricing problem
Veeam gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Standard | ~$250/workload | ||
| Advanced | ~$350/workload | ||
| Premium | ~$450/workload |
Plan Structure (Per Workload VUL, Annual)
| Plan | Price | SCIM |
|---|---|---|
| Standard | ~$250/workload | ❌ |
| Advanced | ~$350/workload | ❌ |
| Premium | ~$450/workload | ✓ |
Note: SCIM 2.0 provisioning with Group Linking, Schema Discovery, and Attribute Writeback is only available in Premium tier. Lower tiers require manual user management despite supporting SAML 2.0 SSO.
What this means in practice
Using current list prices (Standard/Advanced → Premium for SCIM access):
| Workload Count | Upgrade from Standard | Upgrade from Advanced |
|---|---|---|
| 50 workloads | +$120,000/year | +$60,000/year |
| 100 workloads | +$240,000/year | +$120,000/year |
| 200 workloads | +$480,000/year | +$240,000/year |
Calculation: (Premium price - current tier price) × workloads × 12 months
Additional constraints
Summary of challenges
- Veeam supports SCIM but only at Enterprise tier (Premium (~$450/workload VUL))
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Veeam doesn't sell SCIM à la carte. It's bundled with Premium tier features at ~$450 per workload VUL:
The challenge: Veeam's SCIM only works with Okta. Entra ID customers get SAML SSO but still need manual user provisioning. You're also paying premium pricing for backup features when you might only need identity management for a subset of users.
Stitchflow Insight
We estimate ~60% of Premium features are backup-specific capabilities irrelevant for teams that just want automated user provisioning across all major identity providers.
What IT admins are saying
Community sentiment on Veeam's SCIM implementation reveals significant complexity and cost concerns. Common complaints:
- Premium tier requirement (~$450/workload VUL) just for SCIM provisioning
- Multiple Veeam products with inconsistent identity integration capabilities
- Complex external user/group account setup requirements for SSO users
- Limited Azure Entra ID provisioning support compared to Okta
Having to manage external user accounts manually in Veeam even with SSO enabled defeats the purpose of automated provisioning.
The jump to Premium pricing just for SCIM feels excessive when you're already paying hundreds per workload for backup functionality.
The recurring theme
Organizations are forced into premium licensing tiers and complex manual account management processes just to achieve basic automated user provisioning in their backup infrastructure.
The decision
| Your Situation | Recommendation |
|---|---|
| On Standard or Advanced plans, need SCIM | Use Stitchflow: avoid the $100-200/workload premium for Premium |
| Already on Premium with SCIM included | Use native SCIM: you're paying for it |
| Using Entra ID as your IdP | Use Stitchflow: Veeam has no native Entra provisioning |
| Managing multiple Veeam products | Use Stitchflow: unified provisioning across product suite |
| Small backup environment, minimal user changes | Manual may work: but monitor for security gaps |
The bottom line
Veeam gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.
Make Veeam workflows AI-native
Veeam gates SCIM behind Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
None
Key limitations
- Multiple products: Backup & Replication, Service Provider Console, Data Cloud
- SAML 2.0 SSO supported across products
- External User/Group accounts must be created for SSO users
- Veeam Data Platform has three editions: Foundation, Advanced, Premium
- Enterprise Plus includes advanced features like WAN acceleration
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
Docs
Supports Group Linking, Schema Discovery, and Attribute Writeback
Veeam gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app
Where to enable
SAML 2.0 SSO supported; no automated SCIM provisioning from Entra
Use Stitchflow for automated provisioning.
Unlock SCIM for
Veeam
Veeam gates SCIM behind Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.
See how it works
