The SCIM tax: provisioning is plumbing, not a premium

SCIM is the least glamorous protocol in identity. It is a REST API for user records: create, update, deactivate, standardized as RFC 7644 so that directories and apps only ever have to build it once. When your customer's IT team connects their Entra or Okta directory to your product, SCIM is what makes new hires appear in your app on day one and leavers disappear the day they leave. It is plumbing in the most literal sense: unattended, invisible, and only noticed when it is missing.

The going rate for this plumbing is remarkable. WorkOS charges $125 a month per Directory Sync connection, on top of the $125 a month it charges per SSO connection. A SaaS with ten enterprise customers who each want the standard pair, login plus provisioning, is paying $2,500 a month before a single one of their users signs in. Auth0 runs the other classic play: the free tier technically bundles an enterprise connection, but the paid consumer tiers strip enterprise features out, steering anyone who actually needs them onto B2B plans where connections are add-ons at around $100 each. Whichever shape it takes, the message is the same: provisioning lives behind the enterprise gate, next to SAML, priced per connection.

So it is worth asking what a SCIM connection costs the vendor to serve. On the provider side, a connection is a bearer token and a base URL. The traffic is a trickle: one HTTP request when someone joins, one when they change teams or names, one when they leave. No fan-out, no compute worth mentioning, no storage story. The spec exists precisely so that the implementation is a one-time cost: once you have built /Users and /Groups with PATCH semantics, connection number two hundred costs exactly what connection number two cost, which is a row in a table. $125 a month per connection is not cost recovery. It is a segmentation fence, placed where enterprise buyers stand because enterprise buyers can pay. We have counted that bill in dollars for SSO already; SCIM is the same tax collected at a second tollbooth.

But SCIM is not SSO, and the difference is what happens when you do not pay. Decline the SSO fee and logins get worse: more passwords, more phishing surface, an annoyed IT department. Inconvenient, survivable. Decline the SCIM fee and offboarding breaks. The most important message SCIM ever carries is the one that says this person has left the company, deactivate them everywhere, now. Without it, deprovisioning is a human remembering to click through the admin console of every SaaS product the company uses, on the day someone is walked out, with no step missed. In practice that means ex-employees keep working accounts for days, sometimes months. Auditors ask about timely deprovisioning in every SOC 2 and ISO 27001 review for a reason: the dormant account of a departed employee, password unchanged, is one of the oldest breach entry points there is.

Which means deprovisioning is not a convenience feature. It is a security control, and a per-connection fee on SCIM is a price tag on that control. Notice where the risk goes when a buyer declines the fee: nowhere on the vendor's side. The vendor serves exactly the same product. The gap opens on the customer's side, in the offboarding checklist that now depends on memory instead of automation. Charging for SCIM is charging for the lock on a door you already sold.

There is a simple way to read any vendor's price sheet: things that cost real money to serve get priced by usage, and things that cost nothing get priced by what you can refuse. Per-user and per-MAU pricing tracks actual cost. A per-connection fee on a standardized protocol tracks leverage, and SCIM carries the most leverage of all, because enterprise security questionnaires mandate it. The buyer cannot say no, and the price is set accordingly. That is the SCIM tax: not a fee for a service, but a toll on a compliance requirement.

We think the toll booth is the wrong business. Authagonal includes SCIM on every plan, the free tier included, with unlimited connections, same as SSO. Provisioning is plumbing. We charge for the thing that actually costs us something, which is active users, and the switch that turns a leaver's account off everywhere is not a premium. It is the job.