TL;DR

• Many SaaS applications lack SCIM provisioning support, and among those that do offer it, most restrict it to enterprise pricing tiers, which means most SMB toolchains have real gaps even when a team manages access carefully.

• Sign-in with Google (SSO via SAML or OAuth) stops a departed employee from logging in again if the app enforces Google-only sign-in and has no local password or open sessions, but it does not delete their account, files or data inside the app itself.

• Admin-invite workflows, group-based invitations and shared password managers all work, but every one of them depends on a human remembering to act, every time, for every app.

• A per-app inventory that records exactly how each non-SCIM app is provisioned and deprovisioned is the single highest-leverage document a small company without dedicated IT can build.

• For apps without SCIM, the realistic goal is not automatic provisioning. It is a reliable, owned process: a task list generated automatically for the admin to work through or hand to the app owner, then tracked to completion.

About the Author: This article is written by the ShiftControl team. ShiftControl was built by ex-ExpressVPN operators and is purpose-built for Google Workspace, for companies that run IT without a dedicated IT team.

Why Do So Many SMB-Priced Apps Not Support SCIM?

SCIM (System for Cross-domain Identity Management) 2.0 is the IETF standard, defined under RFCs 7642, 7643 and 7644, that lets a directory like Google Workspace automatically create, update and remove user accounts in a connected app. Identity platforms such as Okta, Microsoft Entra ID, Auth0, Clerk and WorkOS support it, and Google Workspace acts as a provisioning client for the supported apps in its catalog rather than as a SCIM server. The standard itself isn’t the problem.

The problem is pricing. Stitchflow’s analysis of 721 SaaS apps found that only about 1.2% offer SCIM on the base tier, while most gate it to enterprise plans or don’t offer it at all, a figure also reported by. Vendors treat SCIM as a signal of enterprise readiness and price it accordingly, so automated provisioning often means moving from an affordable plan to a custom enterprise contract. For a 40-person company paying for a project management tool, a signature tool and a handful of niche apps, that enterprise tier is rarely worth the jump, so the app stays on manual provisioning indefinitely.

Apps without SCIM aren’t an edge case. They’re the default state for most of the stack outside of Google Workspace and a few flagship tools.

Google Workspace’s own automated user provisioning covers supported catalog SAML apps only: up to 3 apps on Business Starter and up to 100 on Business Standard and above Google. Anything outside that catalog needs one of the workarounds below.

What Are the Realistic Options for Provisioning Without SCIM?

Since full SCIM integration isn’t available for most of these apps, the realistic question becomes which manual or semi-automated method fits each app’s risk level. Here are the main workarounds, roughly ordered from lowest to highest effort.

1. Sign-in with Google (SAML or OAuth) with just-in-time provisioning

Many apps that lack SCIM still support “Sign in with Google” using SAML or OAuth. The first time an employee authenticates, the app creates an account automatically, a pattern called just-in-time (JIT) provisioning.

• Setup: Configured once per app, in the app’s admin settings and, for SAML, in the Google Admin console.

• Strength: Removes password creation entirely and ties initial login to the employee’s Google identity.

• Weak point: JIT provisioning only governs the moment of account creation. It has no equivalent at offboarding. Suspending a user in Google Workspace blocks new sign-ins, but it does nothing to the account, seats or data already living inside the third-party app.

2. Vendor APIs (non-SCIM, app-specific)

Some vendors expose a proprietary REST API for user management even without implementing the SCIM standard.

• Strength: Can be scripted to automate creation and removal on a schedule.

• Weak point: Every API is different, so there’s no reusable playbook across apps. Security also depends heavily on how the API token is handled. Long-lived or overly permissive bearer tokens, stored insecurely or shared across scripts, create their own exposure, sometimes a bigger one than the manual process they replace.

3. Admin-invite workflows with checklists

This is the default for most SMBs: someone with app-admin rights manually sends an invite, assigns a role and later manually removes the user.

• Strength: Works for any app and needs no technical setup.

• Weak point: Entirely dependent on a human following a checklist consistently, for every hire and every termination, across every app. Checklists help, but they don’t notify anyone when a step is skipped. Delayed deprovisioning from a missed step is exactly how “zombie accounts,” active credentials for people who no longer work there, accumulate over time.

4. Group-based invitations

Instead of inviting users one by one, some apps let you connect to a Google Group and automatically grant access to anyone added to that group.

• Strength: Reduces the invite step to “add to group,” which is faster and less error-prone than individual invites.

• Weak point: Removal from the group typically revokes access going forward, but, like JIT provisioning, rarely deletes the underlying account or the data tied to it inside the app.

5. Password managers for shared logins

For apps where individual accounts aren’t practical, teams often share one login via a password manager with shared vaults, such as 1Password.

• Strength: Centralizes credential storage and enables controlled, logged sharing instead of logins pasted in Slack or spreadsheets.

• Weak point: Shared logins mean no per-user audit trail. When someone leaves, you rotate the shared password, which disrupts the whole team and still gives you no record of who did what.

Why Does Offboarding Expose the Real Weak Point in Every Workaround?

Every workaround above handles onboarding reasonably well, because granting access is a single, visible action someone remembers to do. Offboarding is where the gap shows up, because removing access is an invisible action nobody notices has been skipped.

Think of it like moving a tenant out. Changing the locks (suspending Google Workspace sign-in) stops them walking back in the front door. It leaves untouched the spare key they still hold to the shed (a non-SCIM app account), the mail still arriving in their name (stored data and files inside that app) and the subscription still billing on autopilot (an active seat nobody canceled).

This matters directly for compliance. Frameworks like SOC 2, ISO 27001 and HIPAA all require timely deprovisioning and a reliable audit trail showing who had access to what, and when it was removed. A workaround that leaves an account live in a billing app for weeks after termination creates security risk and a gap in the audit evidence an assessor will ask about.

How Should a Company Build a Per-App Provisioning Inventory?

Given how different each workaround’s failure mode is, the fix starts with documentation, not more tooling. Before adding automation, every company should maintain a living inventory that records, per app:

This single table turns “we think we handle offboarding” into something an auditor, or a new hire taking over IT duties, can actually verify.

How Can a Guided Task List Close the Gap Without Full SCIM?

Building and maintaining that inventory by hand across dozens of apps is the kind of work that doesn’t scale with headcount. ShiftControl handles the part that can be automated: Google Workspace access is set up and removed automatically when someone joins, moves or leaves. For every other app, with or without SCIM, ShiftControl does not change access itself. Its Work Items feature generates the onboarding or offboarding task list the moment the directory changes, for the admin to work through or hand to the app owner, so the step no longer depends on someone remembering. You can also export app assignments and authorization history as evidence for audits.

Shared credentials and vendor-side data deletion still need a person to act, so these apps remain less precise than true SCIM. The difference is that the work is listed, visible and tracked to completion.

Frequently Asked Questions

Can Sign-in with Google replace SCIM provisioning entirely?

No. It automates account creation at first login but has no mechanism for removing the account, its data or its license at offboarding.

Is it safe to use one shared login for a non-SCIM app across a team?

It’s workable for low-risk, low-data tools, but it removes individual audit trails and makes offboarding one person disruptive to the whole team.

Do vendor APIs count as SCIM integration?

No. A proprietary API can automate similar tasks, but it isn’t the standardized SCIM protocol and requires custom, app-specific scripting that doesn’t transfer to other tools.

What’s the single biggest risk of relying on manual admin-invite checklists?

Delayed or skipped deprovisioning, which creates standing access for former employees, directly weakening SOC 2, ISO 27001 and HIPAA audit posture.

Will SCIM support become more common in SMB-tier plans?

Possibly, but currently only a small fraction of SaaS apps include it in their base tier, with most vendors still reserving it for enterprise pricing.

Does ShiftControl make a company SOC 2 or ISO compliant?

No. ShiftControl lets you export app assignments and authorization history as evidence, but the certification decision itself belongs to the auditor or certifying body.

What should a company without IT staff do first?

Build the per-app inventory above before buying any tool. Knowing exactly how each app is provisioned and deprovisioned today is the foundation for deciding what to automate.

About ShiftControl

ShiftControl is purpose-built for Google Workspace, for companies that run IT without a dedicated IT team. Google Workspace access is set up and removed automatically when someone joins, moves or leaves, and everything else runs as a guided task list for the app owner. You can see every app and OAuth scope connected to your Workspace and track SaaS spend and renewals. You can also export app assignments and authorization history as audit evidence. Cyber incident response (IR-1, via Blackpanda) is included in every subscription. ShiftControl is SOC 2 Type 2 compliant, ISO 27001 certified and signed the CISA Secure by Design Pledge in 2024. Setup takes as little as 10 minutes with a Google Workspace admin sign-in.

Start a 14-day free trial, no credit card required.

References

1. SCIM Gap Analysis (stitchflow.com)

2. Auth Platforms With SSO and SCIM in the Base Tier (clerk.com)

3. About automated user provisioning (Google Workspace Admin Help)