Summary and recommendation
Veeam supports native SCIM 2.0 provisioning, but only on the Premium tier (~$450/workload VUL). For teams on Standard or Advanced plans, there's no automated user provisioning—IT must manually create external user/group accounts before SSO can work. This creates a significant gap: while SSO authentication works across all Veeam products (Backup & Replication, Service Provider Console, Data Cloud), the provisioning piece requires a costly tier upgrade.
The Premium requirement creates a real operational burden. Without automated provisioning, every new hire, role change, or departure requires manual intervention in Veeam's console to create or update external user accounts. SSO alone doesn't solve this—users still need their accounts provisioned first. For organizations with frequent personnel changes or strict compliance requirements, this manual process becomes a security risk and administrative bottleneck.
The strategic alternative
Veeam gates SCIM behind Enterprise. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across the rest of your stack. Stitchflow builds and maintains the IT workflows your team still runs manually, across every app, including the ones without APIs.
Quick SCIM facts
| SCIM available? | Yes |
| SCIM tier required | Enterprise |
| SSO required first? | No |
| SSO available? | Yes |
| SSO protocol | SAML 2.0 |
| Documentation | Not available |
Supported identity providers
| IdP | SSO | SCIM | Notes |
|---|---|---|---|
| Okta | ✓ | ✓ | OIN app with full provisioning |
| Microsoft Entra ID | ✓ | ❌ | SSO only |
| Google Workspace | ✓ | JIT only | SAML SSO with just-in-time provisioning |
| OneLogin | ✓ | ✓ | Supported |
The cost of not automating
Without SCIM (or an alternative like Stitchflow), your IT team manages Veeam accounts manually. Here's what that costs:
The Veeam pricing problem
Veeam gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.
Tier comparison
| Plan | Price | SSO | SCIM |
|---|---|---|---|
| Standard | ~$250/workload | ||
| Advanced | ~$350/workload | ||
| Premium | ~$450/workload |
Plan Structure (Per Workload VUL, Annual)
| Plan | Price | SCIM |
|---|---|---|
| Standard | ~$250/workload | ❌ |
| Advanced | ~$350/workload | ❌ |
| Premium | ~$450/workload | ✓ |
Note: SCIM 2.0 provisioning with Group Linking, Schema Discovery, and Attribute Writeback is only available in Premium tier. Lower tiers require manual user management despite supporting SAML 2.0 SSO.
What this means in practice
Using current list prices (Standard/Advanced → Premium for SCIM access):
| Workload Count | Upgrade from Standard | Upgrade from Advanced |
|---|---|---|
| 50 workloads | +$120,000/year | +$60,000/year |
| 100 workloads | +$240,000/year | +$120,000/year |
| 200 workloads | +$480,000/year | +$240,000/year |
Calculation: (Premium price - current tier price) × workloads × 12 months
Additional constraints
Summary of challenges
- Veeam supports SCIM but only at Enterprise tier (Premium (~$450/workload VUL))
- Google Workspace users get JIT provisioning only, not full SCIM
- Our research shows teams manually provisioning this app spend significant hidden costs annually
What the upgrade actually includes
Veeam doesn't sell SCIM à la carte. It's bundled with Premium tier features at ~$450 per workload VUL:
The challenge: Veeam's SCIM only works with Okta. Entra ID customers get SAML SSO but still need manual user provisioning. You're also paying premium pricing for backup features when you might only need identity management for a subset of users.
Stitchflow Insight
We estimate ~60% of Premium features are backup-specific capabilities irrelevant for teams that just want automated user provisioning across all major identity providers.
What IT admins are saying
Community sentiment on Veeam's SCIM implementation reveals significant complexity and cost concerns. Common complaints:
- Premium tier requirement (~$450/workload VUL) just for SCIM provisioning
- Multiple Veeam products with inconsistent identity integration capabilities
- Complex external user/group account setup requirements for SSO users
- Limited Azure Entra ID provisioning support compared to Okta
Having to manage external user accounts manually in Veeam even with SSO enabled defeats the purpose of automated provisioning.
The jump to Premium pricing just for SCIM feels excessive when you're already paying hundreds per workload for backup functionality.
The recurring theme
Organizations are forced into premium licensing tiers and complex manual account management processes just to achieve basic automated user provisioning in their backup infrastructure.
The decision
| Your Situation | Recommendation |
|---|---|
| On Standard or Advanced plans, need SCIM | Use Stitchflow: avoid the $100-200/workload premium for Premium |
| Already on Premium with SCIM included | Use native SCIM: you're paying for it |
| Using Entra ID as your IdP | Use Stitchflow: Veeam has no native Entra provisioning |
| Managing multiple Veeam products | Use Stitchflow: unified provisioning across product suite |
| Small backup environment, minimal user changes | Manual may work: but monitor for security gaps |
The bottom line
Veeam gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Close the Veeam workflow gap
Veeam gates SCIM behind Enterprise, but the bigger issue is the workflow around it. Stitchflow builds and maintains the offboarding, access review, or license workflow underneath.
Technical specifications
SCIM Version
2.0
Supported Operations
Create, Update, Deactivate, Groups
Supported Attributes
Not specifiedPlan requirement
Enterprise
Prerequisites
None
Key limitations
- Multiple products: Backup & Replication, Service Provider Console, Data Cloud
- SAML 2.0 SSO supported across products
- External User/Group accounts must be created for SSO users
- Veeam Data Platform has three editions: Foundation, Advanced, Premium
- Enterprise Plus includes advanced features like WAN acceleration
Documentation not available.
Configuration for Okta
Integration type
Okta Integration Network (OIN) app with SCIM provisioning
Where to enable
Required credentials
SCIM endpoint URL and bearer token (generated in app admin console).
Configuration steps
Enable Create Users, Update User Attributes, and Deactivate Users.
Provisioning trigger
Okta provisions based on app assignments (users or groups).
Docs
Supports Group Linking, Schema Discovery, and Attribute Writeback
Veeam gates SCIM behind Enterprise. The upgrade may unlock provisioning, but the workflow still has to complete across the rest of your stack.
Configuration for Entra ID
Integration type
Microsoft Entra Gallery app
Where to enable
SAML 2.0 SSO supported; no automated SCIM provisioning from Entra
Use Stitchflow for automated provisioning.
Close the workflow gap in
Veeam
Veeam gates SCIM behind Enterprise plan. That can unlock provisioning, but it still does not complete the offboarding, access review, or license workflow across your stack.
Start with the free gap diagnostic
