The SCIM Tax: Why Automated Provisioning Is Locked Behind Enterprise Pricing

The SCIM tax is what you pay when a SaaS app locks user provisioning behind its enterprise plan. Here's the real math, the worst offenders, and how to avoid it.

TL;DR

• The "SCIM tax" is the cost of upgrading to an app's enterprise plan only to unlock SCIM user provisioning — automation that should arguably be standard.
• Real examples: Notion gates SCIM to Enterprise; Asana puts it on Enterprise ($35/user) versus Advanced ($25); Adobe's Teams plan has no SCIM at all.
• The cost is the tier jump times every seat. A 50-person Asana team upgrading just for SCIM pays roughly $6,000 extra a year — for one app.
• The term isn't ours; Stitchflow and others use it too. This post adds the math and the way around it.
• You can avoid it with browser automation: automate the gated apps' admin consoles directly instead of paying the tier.

What the SCIM tax is

The SCIM tax is what you pay when a SaaS vendor locks SCIM user provisioning behind its most expensive plan. SCIM — the standard that lets your HR system or IdP automatically create, update, and deactivate accounts in an app — is exactly the feature an IT operator needs to offboard cleanly. And it's exactly the feature many vendors reserve for the enterprise tier.

So you face a choice that isn't really about the app's value: pay the enterprise price for every seat to unlock provisioning, or leave that app on manual offboarding. For a 250-person company running 15 apps, that decision repeats over and over, and the bill adds up.

To be fair about the name: KINT didn't coin "SCIM tax." Stitchflow, among others, has written about the SCIM provisioning tax on project-management tools. It's used because it's the clearest label for a real pattern. What this post adds is the worked math and the browser-automation way around it.

Why does SCIM cost a tier? (The honest reason)

Building and maintaining a SCIM endpoint takes real engineering, and vendors prioritise it for the buyer who will churn without it — the enterprise. Below that line, provisioning gets deprioritised or used as an upsell lever to push teams onto the top plan.

That's a defensible business decision for the vendor. It's still a cost the mid-market IT operator didn't choose. The same dynamic explains why roughly 40% of mid-market apps don't support SCIM at the plan tier most companies are on — sometimes because it's gated, sometimes because it was never built.

The worst offenders (verified, June 2026)

Here's the live state of provisioning gating on widely deployed mid-market apps. Where an app is fairer than its reputation, that's noted too.

The pattern across the project-management category is consistent: not one of the big PM tools offers SCIM on a standard plan. Slack is the honest exception worth naming — its provisioning sits at a mid tier, so don't lump it with Notion and Asana.

The math: what the tax actually costs

The cost of the SCIM tax is simple to compute: (enterprise per-seat price − your current per-seat price) × number of seats × 12. The catch is that you pay it on every seat, even though provisioning is the only feature you need.

Asana, 50 seats. Advanced is about $25/user/month; Enterprise is about $35. Upgrading only to get SCIM is roughly $10/user/month × 50 × 12 = about $6,000 a year — for one app.

Now stack it. A 250-person company rarely has just one gated app. Say three apps each force a comparable tier jump. You're into five figures a year of forced spend, none of which buys you anything except the ability to turn accounts off automatically.

And the part the spreadsheet misses: if you don't pay the tax, those apps fall back to manual offboarding. That's where ghost accounts live — the ex-employee whose Notion or Adobe access stays open for days because nobody's IdP could reach it.

Honest labelling: the per-app prices above are published vendor list prices verified in June 2026; the multi-app total is an illustrative worked example, not a measured figure from a KINT customer. Your tiers and seat counts will differ — run the formula on your own stack.

The three ways to deal with it

Paying the tax makes sense if you genuinely want the enterprise plan for reasons beyond provisioning. Staying manual stops being viable above a handful of leavers a year, because the median offboarding lag runs around 11 days at companies without automation, and "we sent a ticket" isn't audit evidence. That leaves the third option for most mid-market teams.

How browser automation avoids the tax

Browser automation closes the same lifecycle gap as SCIM without the enterprise upgrade. Instead of calling a SCIM endpoint you don't have, the platform drives the app's admin console the way an IT admin would — sign in, find the user, deactivate the account, unassign the license — and signs the evidence for each step.

KINT does this for Adobe Admin Console today. When a leaver event fires, KINT opens the Adobe console, removes the user from each licensed product, captures a screenshot per action, signs it with Ed25519, and maps it to SOC 2 CC6.3 — in about 5 seconds per seat (the full Adobe walkthrough). Crucially, this works on Adobe's Teams plan, where SCIM doesn't exist — so you get the automation without buying Adobe Enterprise.

In KINT's joiner-mover-leaver engine, the routing is automatic: SCIM apps get SCIM, API apps get API, gated or API-less apps get browser automation. You don't pay the enterprise tier just to switch accounts off. Browser automation is on the Growth plan ($5/employee/month) for up to 5 apps; pricing is on /pricing, published.

FAQ

What is the SCIM tax?

It's the cost of upgrading to a SaaS app's enterprise plan purely to unlock SCIM user provisioning — the automated create, update, and deactivate that an IT team needs for clean offboarding. Apps like Notion and Asana put SCIM only on the top tier, so a team that wants automated provisioning pays the enterprise price on every seat, even though provisioning is the only feature it needs.

Which apps charge the worst SCIM tax?

Notion (SCIM is Enterprise-only; Business has SSO but no provisioning) and Asana (SCIM only on Enterprise at ~$35/user vs ~$25 on Advanced) are clear cases. Adobe's Teams plan has no SCIM at all, and Adobe Enterprise SCIM only syncs from Microsoft Entra or Google Workspace. Slack is fairer — it includes SCIM at the mid Business+ tier.

How much does the SCIM tax actually cost?

It's the tier jump times every seat times 12. Asana is a clean example: moving a 50-person team from Advanced ($25/user/month) to Enterprise ($35) just for SCIM adds roughly $6,000 a year for that one app. Stack three or four gated apps and forced spend climbs into five figures annually — for automation you'd otherwise get from your lifecycle platform.

How do I avoid paying the SCIM tax?

Use browser automation for the gated apps. A lifecycle platform with a browser-automation path drives the app's admin console directly, so you get automated, evidenced deprovisioning without the upgrade. KINT does this for Adobe Admin Console today and routes SCIM, API, and browser-automation apps in one workflow.

Did KINT invent the term "SCIM tax"?

No. The phrase is already used in the industry — Stitchflow, among others, has written about the SCIM provisioning tax on project-management tools. KINT uses it because it's the clearest name for a real pricing pattern, and adds the worked math and the way around it.

Is paying the SCIM tax ever the right call?

Yes — when you want the enterprise plan's other features anyway, the SCIM upgrade is incidental and worth it. The tax only stings when provisioning is the single reason you'd upgrade. In that case, browser automation gets you the same lifecycle coverage without changing your plan.

Provisioning shouldn't cost you a pricing tier. For the apps that gate it, browser automation closes the same gap without the upgrade.

Start free for 14 days →

14-day trial · No card · Live in under an hour

KINT (by Kingsley Integrators) is an HR-driven identity lifecycle automation platform for companies with 100–500 employees. It automates onboarding, role changes, and offboarding across SaaS apps — including the apps without APIs, via browser automation — and produces SOC 2 CC6 audit evidence as a byproduct. Pricing is published per employee per month ($3 Starter, $5 Growth). Self-serve signup at kingsleyint.com.