TL;DR
SCIM provisioning is built into Microsoft Entra ID, even on the Free tier. For apps that support it, accounts are created, updated and removed automatically.
The limit is coverage. Most SaaS apps only offer SCIM on their enterprise plan, so most companies connect a small fraction of their stack. From what we see across customer SaaS stacks, that's about 15–25% of apps.
The rest is a long tail done by hand. Among AccessOwl customers under 1,000 employees, the median company manages about 35 apps in its access management tool. Counting shadow apps, it's 70–150 (State of SaaS Access Management 2026). Putting all of them on SCIM is rarely realistic.
To cover the rest, teams stay manual, pay each app's enterprise plan, build their own API scripts, or add an access management layer like AccessOwl that doesn't need SCIM.
Intro
Traditional SaaS access management on a Microsoft environment looks like this: A new hire starts, Microsoft Entra ID (formerly Azure AD) sets up the Microsoft 365 accounts. Then the IT admin (or the person covering IT duties) starts on the rest of the app list. The CRM, Notion, and the design tool are owned by different managers. Each app owner gets a message, a follow up, and they update the access spreadsheet if they remember.
SCIM provisioning helps automate the creation of app accounts in third party SaaS tools. SCIM provisioning in Entra ID works well. But most companies have a small fraction of apps (if any at all) connected to SCIM. This guide covers how it works, why most teams only have a few apps connected via SCIM, and how teams on Microsoft 365 cover the apps it can't reach.
What is SCIM provisioning in Microsoft Entra ID, and how does it work?
SCIM (System for Cross-domain Identity Management) is the open standard Microsoft Entra ID uses to create, update and remove user accounts in other apps. It's Entra ID's default way to provision SaaS apps, and it's included on every Entra ID tier, even Free. Whether it works depends on the app. Each app has to support SCIM, and many only do on their enterprise plan.
Here's what happens once an app is connected via SCIM to Entra ID:
IT assigns a user or group to the app in Entra ID.
Entra ID's provisioning service creates the account in the app through the app's SCIM endpoint.
It keeps details like name, email and department in sync.
When IT unassigns the user, blocks their sign-in or deletes them, the service deactivates the account in the app. It deletes the account 30 days later, when Entra ID permanently deletes the user (Microsoft Learn).
Entra ID doesn't know on its own that someone has left. It reacts to changes in the directory. Someone has to disable or remove the user first, whether that's IT or an HR system synced into Entra ID. To connect an app, you need a SCIM connector for it, either from the Microsoft Entra app gallery or as a custom app pointed at the app's SCIM endpoint.
Which Entra ID license do you need? Provisioning users to SaaS apps works on Microsoft Entra ID Free. Assigning apps to groups and viewing the provisioning logs need Microsoft Entra ID P1, which comes with Microsoft 365 Business Premium and E3 (Microsoft Learn). The other route is an access management tool like AccessOwl. It grants apps through your existing Microsoft groups and logs every access change, including in apps outside Entra ID.
Provisioning Microsoft apps vs third-party SaaS apps in Entra ID
Microsoft's own apps don't need SCIM. Outlook, Teams, OneDrive and SharePoint come with the Microsoft 365 license, so assigning the license gives access. Third-party SaaS apps are separate. Entra ID can only create accounts in them through a SCIM connector.
That's why "we're all on Microsoft" can still mean 30 apps managed by hand. An analyst at a ~1,100-user real estate and investment firm summed it up for us:
"The thing is, is that Entra only provisions maybe three out of the 12 applications that we're shooting for."
Analyst, ~1,100-user real estate and investment firm
What are the limitations of Entra ID SCIM provisioning?
For the apps it reaches, Entra ID's SCIM provisioning works well. The main limitation is how many apps within your stack is reachable. Most apps put SCIM behind an enterprise plan, sometimes called the SCIM tax, so IT teams only connect a fraction of their apps. Everything else becomes manual work. And even connected apps leave gaps around end dates, contractors, permission levels and shadow IT.
Limitation 1: the SCIM tax keeps most apps outside of coverage
Every app that keeps SCIM on its enterprise plan asks for a per-seat upgrade before Entra ID can connect. For Slack and Notion alone, a 70-person company pays more than $14,910 a year extra.
If most of your apps are already on enterprise plans, this may not be an issue. This can be the case for large enterprises, but is rare for companies under 1,000 people.
A CISO at an insurance and financial group described the wall:
"We have Adobe for our legal team. In order to get single sign on, you have to go to a whole different pricing tier."
CISO, insurance and financial group
Limitation 2: the long tail becomes manual work
The apps outside SCIM don't go away. Someone still creates and removes every account by hand.
Among AccessOwl customers under 1,000 employees, the median company manages about 35 apps. "Managed" means apps in their access management tool, where users are tracked and access requests go through a formal process. Counting shadow apps, it's 70–150 ( State of SaaS Access Management 2026).
That translates to manual work for IT admins and department managers:
Onboarding: a new hire needs access to a median of 9 apps, held by 5 different app managers
Offboarding: a leaver has to be removed from a median of 17 apps, held by 8 different app managers
Putting every app on SCIM is rarely feasible. So IT handles a long tail of apps by hand, or department managers do it after IT chases them. And the user lists rarely get updated, so nobody has a reliable record of who has access to what. Our Microsoft 365 offboarding guide covers the leaver side in detail.
Limitation 3: gaps that remain even with SCIM connected
Switching SCIM on for an app solves account creation and removal. Some everyday requests still fall outside it.
Gap | With Entra ID SCIM provisioning | What teams do instead |
|---|---|---|
Time-based access (a project, an audit, a trial) | An app assignment has no end date. Access that expires on its own needs access packages in entitlement management, on Microsoft Entra ID P2 or ID Governance. | By hand: a calendar reminder to remove it. With AccessOwl: access is granted for a set period and removed automatically when it ends. |
Contractors and freelancers without a Microsoft 365 account | Entra ID only provisions people who exist in its directory. Someone without a work account gets nothing from SCIM. | By hand: invited in each app by the department that hired them, and removed by hand later. With AccessOwl: contractors and freelancers get access with their own email address, no Microsoft 365 account needed. |
Permission levels and seat types (admin or member, paid or free seat) | SCIM creates and removes the account. Many apps' SCIM sets a basic role at most, so channels, teams and project roles are left to set by hand. | By hand: set in the app's admin panel after the account exists. With AccessOwl: the permission level is picked in the access request and set when the account is created. |
Shadow IT and shadow AI outside SSO | Provisioning only reaches apps you've connected. Apps people sign up for themselves stay invisible to it. | By hand: ask managers, check expense reports and search inboxes for sign-up emails. With AccessOwl: a shadow IT discovery scan finds the apps people signed into with their Microsoft account. |
Requests and approvals | Whoever is in the group gets the account. Asking and approving happens somewhere else, or in entitlement management on P2 or ID Governance. | By hand: tickets, forms and DMs, then IT chases the approver. With AccessOwl: employees request apps on the web dashboard, and approvers are notified by email. |
Source for the Microsoft tiers: Microsoft Learn licensing, checked November 2026.
Shadow IT doesn't show up anywhere in Entra ID's provisioning. A Director of GRC at a ~206-employee software company told us how many apps that can be:
"Employees can still can log into 62 other applications with their email and password and we don't know about it."
Director of GRC, ~206-employee software company
None of this is unique to Microsoft. Okta has the same SCIM boundary. Any identity provider stops at the apps that are connected.
Calculating the SCIM tax for Microsoft Entra ID
The SCIM tax is the extra you pay an app vendor to unlock SCIM, because most vendors only include it on their business or enterprise plan. Microsoft Entra ID doesn't charge it. The apps do. For Slack and Notion alone, a 70-person company pays more than $14,910 a year extra.
Slack and Notion both work with Microsoft Entra ID provisioning. Here's what it takes to switch SCIM on for a 70-person company:
App | Seats | Plan most teams start on | First plan with SCIM | Extra per seat per month | Extra per year |
|---|---|---|---|---|---|
Slack | 70 | Pro, $7.25 | Business+, $15 | +$7.75 | $6,510 |
Notion | 70 | Plus, $10 | Enterprise, custom price (Business, $20, adds SSO only) | more than +$10 | more than $8,400 |
Both apps | more than $14,910 a year |
That's two apps. Among companies under 1,000 employees, the median AccessOwl customer manages about 35. The cost is per seat, per app, every year, and it grows with every hire.
Prices from Slack pricing and Notion pricing, annual billing, checked November 10, 2026. Slack lists SCIM as "available on the Business+ and Enterprise plans". Notion lists "User provisioning (SCIM)" on Enterprise. For why vendors price it this way, see our guide to the SSO tax. For a community-kept list of apps that charge extra for SSO, see the SSOtax.org Wall of Shame.
Which apps does Entra ID cover with SCIM provisioning?
Entra ID covers apps that have a provisioning connector in the Microsoft Entra app gallery, plus any app with a SCIM 2.0 endpoint you add yourself. In practice, coverage depends less on Microsoft than on each app's pricing. Many gallery apps only turn SCIM on with their enterprise plan.
How can teams on Microsoft provision apps outside Entra ID SCIM?
Teams that want the apps SCIM doesn't reach automated add a SaaS access management layer like AccessOwl. It creates and removes accounts in apps without SCIM and runs requests and approvals in one place. The other routes are staying manual with tickets, spreadsheets and DMs, or building your own scripts, one per app.
Option 1: Add a SaaS access management layer like AccessOwl
Keep Entra ID for sign-in and for the apps already on SCIM. AccessOwl covers the rest through integration accounts, with provisioning that doesn't need SCIM, so apps can stay on their current plans. Access requests, approvals and a record of who has access to what live in the same place. See how AccessOwl for Microsoft 365 works.
Option 2: Manually, with tickets, spreadsheets and DMs
Most teams start here. An employee asks for access by ticket, email or chat. IT chases the approver, then creates the account or asks the app's owner to. Someone updates the access spreadsheet if they remember. At offboarding or audit time, IT chases the app owners again.
A security and IT manager at a cybersecurity software company told us:
"It's mostly manual. Although we are using some Microsoft forms to provision, but in reality it's manual."
Security and IT manager, cybersecurity software company
Manual works for a handful of low-risk apps. The cost grows with every hire, every leaver and every audit.
Option 3: Do it yourself with APIs, scripts and integration tools
Teams with developers build their own provisioning. They write scripts against each app's API, build flows in Power Automate or Logic Apps, or chain sign-ups together in an integration platform.
It works, but every app is its own project. Each one needs a token stored and rotated, updates when the app's API changes, error handling and retries, an offboarding path that really removes access, and its own log for the auditor.
How to provision and manage SaaS access outside Microsoft Entra ID SCIM
Keep Microsoft Entra ID for sign-in. For apps outside SCIM, you either do the work by hand in each app, or let AccessOwl create and remove the accounts and run the requests and approvals.
How to create accounts for SaaS apps in Microsoft Entra ID without SCIM
Entra ID can't create the account itself in an app without SCIM, so something else has to.
By hand: IT or the app's owner invites the person in each app and sets their role. With a median of 9 apps across 5 app owners per new hire, this is where the chasing starts.
With AccessOwl: accounts and permissions are created through an integration account on the person's start date, which syncs from your HRIS, or as soon as their access request is approved. No need for IT, HR, or Operations personnel to open up admin consoles one by one.
How to remove access to SaaS apps in Microsoft Entra ID without SCIM
Disabling the user in Entra ID stops sign-in through SSO. It doesn't remove the account inside apps without SCIM, so the license and the data stay.
By hand: work from a list of every app the person used and remove them in each one. The hard part is having a full list. A leaver has a median of 17 apps across 8 different people.
With AccessOwl: the person is removed from every connected app on their last workday. A Shadow IT discovery scan shows apps outside of central management that need to be removed.
Our Microsoft 365 offboarding guide has the full runbook.
"I was impressed that with AccessOwl I could grant users access and programmatically provision their accounts without having to upgrade to the enterprise tier of the company's applications."
Ethan Yu, Cofounder & COO, from Motion's success story
Which provisioning method is best fit for your situation?
It comes down to how many apps sit outside SCIM, whether they're already on enterprise plans, and who would do the work.
Your situation | Best fit | Why |
|---|---|---|
Fewer than 5 apps outside SCIM | Manual, with a checklist | Not worth new tooling yet |
Most apps already on enterprise plans, and IT has the people to run SCIM connectors (usually large enterprises) | Entra ID SCIM provisioning | You've already paid the SCIM tax |
10+ apps on standard plans, a small IT team, or SOC 2 or ISO 27001 coming up | Microsoft 365 + AccessOwl | Covers the long tail without upgrading every app, with one access record |
Somewhere in between | SCIM for the apps that already have it, AccessOwl for the rest | Keeps what already works |
Automating access management in Microsoft Entra ID environments
Entra ID SCIM provisioning creates and removes accounts in connected apps. Most of the goals IT is measured on reach further than that. Several rows below point to Microsoft's own governance add-on. If you're weighing it, we compared Entra ID Governance alternatives in a separate guide.
What you want to achieve | Entra ID SCIM provisioning | Microsoft 365 + AccessOwl |
|---|---|---|
New hires get all their apps on day one, including apps owned by other department managers | Only the apps on SCIM. The rest waits on each app owner. | Every connected app on the start date. |
Access to SaaS apps removed during offboarding | Deactivated in SCIM apps. Accounts in other apps stay live. | Automatically removed from every connected app on the last workday. Shadow IT apps are discovered and flagged for IT to review. |
Employees request an app and the right person approves | Not included. Access packages need P2 or ID Governance. | Requested on the web dashboard. Once approved, the account is created. |
Temporary access that ends on its own | Access packages on P2 or ID Governance | Access granted for a set period and removed automatically when it ends |
The right role or permission level in each app | Often a basic role at most, depending on the app | Permission level picked in the request and set when the account is created |
Contractors without a Microsoft 365 account | Not covered | Access with their own email address, removed when the engagement ends |
One record of who has access to what, for access reviews | SCIM apps only | Every managed app in one record |
Find apps people signed up for outside SSO | Not part of provisioning | Shadow IT discovery from Microsoft 365 OAuth logs |
FAQs
How do I give a new hire accounts in all their apps on day one with Microsoft 365?
Microsoft Entra ID creates the Microsoft 365 account and the accounts in apps connected through SCIM. Every other app needs someone to create the account, usually the app's owner after IT asks. AccessOwl creates those accounts on the person's start date through integration accounts, so new hires don't wait on each app owner. Apps without an integration get a tracked task.
Why does Entra ID say automatic provisioning isn't supported for my app?
It means the app has no provisioning connector in the Microsoft Entra app gallery. You can still set up SSO for it, but Entra ID can't create or remove accounts there. If the app offers SCIM on a higher plan, you can upgrade and add it as a custom SCIM app. If it doesn't offer SCIM at all, accounts have to be managed by hand, with your own scripts, or with an access management tool like AccessOwl.
What's the difference between SSO and SCIM in Microsoft Entra ID?
Single sign-on (SSO) lets someone sign in to an app with their Microsoft account. SCIM creates, updates and removes their account in that app. Many apps sell the two on different plans, so an app can have SSO with Entra ID and still need someone to create every account by hand. Our SCIM vs SAML guide explains the difference in more detail.
Can Entra ID provision apps that don't support SCIM?
Not on its own. Entra ID's provisioning service talks to apps through SCIM, so an app without SCIM gets no account. The options are managing those apps by hand, building your own API scripts, or adding AccessOwl, which provisions apps through integration accounts with no SCIM needed. We go deeper on this long tail in when SCIM isn't enough.
Can Entra ID groups give the right app access by department or role?
Yes, for apps connected through SCIM, if you're on Microsoft Entra ID P1 or higher. Add the department's group to the app, and everyone in it gets an account. For apps without SCIM, the group does nothing on its own. AccessOwl can grant those apps through the same Microsoft groups.
Does Entra ID remove the app license when someone leaves?
Only in apps connected through SCIM, and only once someone disables, unassigns or deletes the user in Entra ID. In every other app, the account and the paid seat stay until someone removes them. That's how unused licenses pile up after people leave. AccessOwl removes the account in each connected app on the last workday, so the seats free up.
How do I give contractors access to SaaS apps if they don't have a Microsoft 365 account?
Entra ID SCIM provisioning only reaches people who exist in your directory. A contractor without a work account has to be invited in each app by hand, and removed by hand at the end of the contract. AccessOwl handles contractors and freelancers who aren't in your directory. They get access with their own email address, and the access can be set to end on a date, so it's removed when the contract does.
Can Power Automate provision users from Entra ID?
Only as a flow you build and maintain for each app. Entra ID's provisioning service doesn't call Power Automate on its own. Teams use flows to call an app's API when a user joins a group, but each flow needs its own error handling, token upkeep and offboarding path.
Is this the same as HR-driven provisioning in Entra ID?
No. HR-driven provisioning brings people into Entra ID from an HR system such as Workday. SCIM provisioning, covered here, takes people from Entra ID out to SaaS apps. Many teams need both, and apps without SCIM sit outside either one.
Do I need Okta to provision apps without SCIM?
No. Okta has the same SCIM boundary as Microsoft Entra ID. It can only provision apps that support SCIM or that Okta has built its own connector for. Switching identity providers doesn't cover the long tail. A layer like AccessOwl works on top of the identity provider you already have. If you're deciding, see does your company need Okta.
I'm an HR manager and our company uses Microsoft 365. How can I automatically create and remove accounts in our SaaS apps without setting up SCIM or API integrations?
AccessOwl handles this without code. Connecting an app is as easy as inviting a user to your account in that app. From then on, new hires get their accounts on their start date from your HR system, and leavers are removed from every connected app on their last workday. No SCIM, API work or enterprise plans needed.
I'm an operations manager and I own several of our team's tools. How can I stop handling access requests and removals by hand?
With AccessOwl, employees request the tools they need on the web dashboard, and you approve with one click. Once approved, AccessOwl creates the account with the right permission level. When someone leaves, they're removed automatically. Connecting your tools is as easy as inviting a user, with no code or IT project needed.
How do I track who has access to which app without a spreadsheet?
Entra ID shows who is assigned to each connected app. It doesn't track accounts in apps outside it. Most teams keep a spreadsheet for the rest, which goes stale between audits. AccessOwl keeps one live record across every managed app and feeds it into access reviews for SOC 2 and ISO 27001. Our SOC 2 access review guide covers the process.