You are evaluating Auth0’s SCIM (System for Cross-domain Identity Management) provisioning capabilities and want to understand pricing, feature support, and limitations for both inbound SCIM (external systems pushing data into Auth0) and outbound SCIM (Auth0 pushing data to third-party applications like Sigma).
Here are the definitive answers to your three questions:
1. Is SCIM provisioning only available on the Enterprise plan?
Inbound SCIM is considered an advanced, enterprise-grade feature and is only included in the Enterprise plan. However, there is an important exception: all plans (including the free plan) include one free enterprise connection, which means you can use both inbound and outbound SCIM on that specific connection even if you are not on the Enterprise plan.
2. Can Auth0 act as a SCIM client to provision users and groups to third-party SaaS applications?
No. Outbound SCIM is currently not supported by Auth0. Auth0 only supports inbound SCIM (external systems provisioning users into Auth0). There is a backlog item for outbound SCIM, but there is no estimated time of arrival (ETA) at this time.
If you require outbound SCIM functionality to provision users from Auth0 to external applications like Sigma, Auth0 recommends contacting the Professional Services team to discuss a custom outbound SCIM solution. This ensures security and effectiveness for your specific use case.
3. What are the known limitations and configurations required for SCIM provisioning?
For Inbound SCIM (currently supported):
- Schema and Attribute Mapping: SCIM relies on a standard schema. Auth0's provisioning integrations have default attribute mappings. If your upstream application requires custom attributes, you may need to adjust the attribute mappings in the provisioning integration settings to ensure all necessary data is received correctly.
- Group Provisioning: Support for provisioning groups varies by integration. While the SCIM protocol supports groups, you must verify that both Auth0's specific integration and your upstream application fully support group creation and membership updates via SCIM. Inbound SCIM Groups for Enterprise Connections is now in Limited Early Access (as of January 30), so group support is expanding.
- Plan Limitations: If you are on a non-Enterprise plan, you can only use SCIM on your one free enterprise connection. Additional enterprise connections require an Enterprise plan.
- B2C Plan Exclusion: SCIM is not available on the Auth0 B2C plan.
For Outbound SCIM (not currently supported):
There are no official configurations available at this time. If you need this functionality, contact Auth0 Professional Services.
Recommended Next Steps:
If you need inbound SCIM only: You can use the free enterprise connection on any plan to set up inbound SCIM from your upstream identity provider (e.g., Okta, Microsoft Entra ID, Okta Workforce).
If you need outbound SCIM: Contact Auth0 Professional Services to discuss a custom solution. You can also upvote the feature request for outbound SCIM on the Auth0 feedback portal to increase visibility to the product team.
For group provisioning: If you need to provision groups via SCIM, request access to the Limited Early Access program for Inbound SCIM Groups by contacting your Auth0 Account Owner.
We hope this clarifies Auth0's SCIM capabilities. Please follow up if you have additional questions about your specific provisioning requirements.
Kind Regards,
Nik