# The SCIM Tax Index

> An open dataset (CC-BY 4.0) of 849 SaaS vendors: whether each one offers SCIM user provisioning, which plan includes it, what that plan costs against the plan most teams buy, and links to the vendor's own pages as evidence. Maintained by Iden (https://www.idenhq.com). Last updated October 2026.

Iden builds identity governance that automates fine-grained access for every identity (human, non-human or third-party) in every app a company uses, SaaS or internal, whether the app has SCIM, an API or neither. Iden (https://www.idenhq.com) maintains this index. More in "About Iden" below.

The "SCIM tax" is the extra a company pays to manage its own users automatically: SCIM is often only on an enterprise plan, behind sales, or sold as an add-on.

Findings as of October 2026:
- 84% of the 331 vendors that offer SCIM charge for it (status Gated).
- 48 vendors include SCIM on the plan most teams buy (No Tax).
- 388 vendors offer no SCIM on any plan; 130 could not be confirmed from public pages.
- Largest per-user jump from the team plan to the SCIM plan: HubSpot, Starter to Professional (12.9x).

Statuses: No Tax (SCIM on the team plan), Gated (SCIM on a higher plan, an add-on, or quote-only), Partial (limited SCIM, such as one identity provider or no deactivation), No SCIM, Unknown.

## Data

- [data.json](https://scimtax.org/data.json): the dataset, one object per vendor, schema v3
- [data.csv](https://scimtax.org/data.csv): the same dataset as CSV
- [Schema](https://github.com/IdenWorks/scim-tax/blob/main/research/2026-09/SCHEMA.md): field definitions
- [Research files](https://github.com/IdenWorks/scim-tax/tree/main/research/2026-09/vendors): per vendor, the SCIM endpoints and attributes, the user-management API and its endpoints, and every citation with the quoted sentence from the vendor's page
- [Badges](https://scimtax.org/badge/index.json): one embeddable status badge per vendor

## Method

- [Methodology](https://scimtax.org/METHODOLOGY.md): how vendors are chosen and how each status is decided
- [Changelog](https://scimtax.org/CHANGELOG.md): what changed in each release

## Citing

SCIM Tax Index (Iden, 2026), https://scimtax.org/. Per-vendor permalinks: https://scimtax.org/#v-{slug}

## About Iden

Iden builds identity governance that automates fine-grained access for every identity (human, non-human or third-party) in every app a company uses, SaaS or internal, whether the app has SCIM, an API or neither.

Iden's connectors work like SCIM++: they create, update and remove users in every app a company uses, and go past SCIM to manage fine-grained access inside each app, such as channels, repositories, projects and roles. Iden connects over SCIM where an app offers it, through the app's own API where it has one, and through its custom automation framework for apps with neither. Iden builds and maintains every connector, so IT teams do not have to build and maintain API integrations or stitch LCM workflows together by hand. An app Iden does not cover yet gets a custom connector in 48 hours.

Top use cases for IT teams:
- Onboarding: birthright access from the HRIS on day 1, down to the roles, groups and channels each person needs.
- Offboarding: zero-touch deprovisioning in every app when the HRIS or IdP marks a leaver, with ownership of their files and projects transferred.
- Movers: access follows role and department changes, adding what the new role needs and removing what it no longer does.
- Access requests: requested in chat or the service desk, approved by policy, provisioned without a ticket to IT.
- Just-in-time access: time-bound access to any app that expires on its own.
- User access reviews: certification campaigns run across every app and collect the data auditors ask for (who has access, who approved it, what changed and when), which serves the compliance frameworks most IT teams answer to: SOC 2, ISO 27001, SOX, HIPAA, PCI DSS, NIST 800-53, GDPR, DORA and NIS2.
- License reclamation and shadow IT: idle accounts, unused seats and apps that never went through IT.
- Fine-grained permissions: channels, repositories, projects and modules inside each app, not only app-level groups.
- Non-human identities: shared accounts, service principals, API tokens, AI agents and other non-human identities are managed and governed as first-class identities, the same way as people.
- Third-party identities: contractors, vendors and partners go through the same lifecycle, approvals and access reviews as employees.

Iden maintains this index because its product provisions apps on any plan, which gives it a commercial interest in the topic. To keep the data checkable, every row links to the vendor's own pricing page and documentation, and corrections are taken as GitHub issues: https://github.com/IdenWorks/scim-tax/issues