- 01SCIM 2.0 is the standard for cross-system user provisioning. Works well in vendor demos. In production it consistently breaks at the same boundaries.
- 02Where SCIM breaks: group nesting (many SaaS only support flat groups), custom attributes (vendor implementations diverge from spec), rate limits (bulk provisioning hits API limits during M&A or onboarding), bidirectional sync (most SCIM is one-way; reconciling drift is manual), soft vs hard delete semantics differ across apps.
- 03Mitigations: test SCIM with realistic group hierarchies before committing — depth matters. Use orchestration (iPaaS or IGA workflow) for vendors with weak SCIM. Build weekly reconciliation jobs comparing IGA truth to SaaS state and alert on drift.
- 04What good looks like: central IGA truth source, SCIM as primary protocol where supported, documented exceptions with their alternative method, weekly reconciliation. When you fire someone Friday afternoon, every system reflects it before they reach their car.
System for Cross-domain Identity Management (SCIM) 2.0 is the standard for provisioning users between systems. It works well in vendor demos. In production it consistently breaks at the same boundaries.
Where SCIM breaks
- 01Group nesting — many SaaS only support flat groups
- 02Custom attributes — vendor implementations diverge from the spec
- 03Rate limits — bulk provisioning hits API limits during M&A or onboarding
- 04Bidirectional sync — most SCIM is one-way; reconciling drift is manual
- 05Soft delete vs hard delete — semantics differ across applications
Mitigations that work
Test SCIM with realistic group hierarchies before committing to a vendor — depth matters. Use orchestration (an iPaaS or IGA-orchestrated workflow) for vendors with weak SCIM. Build reconciliation jobs that compare IGA truth to SaaS state weekly and alert on drift.
What good looks like
A central IGA truth source. SCIM as the primary provisioning protocol where supported. Documented exceptions with their alternative provisioning method. Weekly reconciliation. The result: when you fire someone on Friday afternoon, every system reflects it before they get to their car.