Provisioning in Caspian
Updated 4 November 2026 by Simon Mestdagh, founder of Caspian.
Caspian, the IT automation platform for scale-ups, creates, changes and removes access for joiners, movers and leavers. It works on three layers, and you start it from chat: the app on the laptop, the account in the app, and the resources inside the app.
Key takeaways
- Your apps do not need SCIM, because Caspian provisions through 4 routes, SCIM, API, browser automation or a task for a person.
- Caspian works on 3 layers: the app on the laptop, the account in the app, and resources inside it such as Slack channels and GitHub repos.
- A change counts as done only after Caspian reads the app back and sees the result.
- Removals never run on their own; a person approves each one.
- Act runs provisioning and offboarding for €10 per active user per month excl. VAT.
What does Caspian provision?
Caspian provisions 3 layers for joiners, movers and leavers: the app on the laptop (Slack, Figma, ChatGPT), the account in the app with its license and role, and the resources inside it, such as Slack channels, Google groups and GitHub repos.
| Layer | Examples | In (joiner) | Out (leaver) |
|---|---|---|---|
| App on the laptop | Slack, Figma, ChatGPT desktop apps | Installed and updated | Removed |
| Account in the app | License, account type, role | Created with the right license and role | Deactivated, then deleted |
| Resources inside | Slack channels, Google groups, GitHub repos, Notion pages, folders, projects | Added | Removed or handed over |
How does Caspian provision apps without SCIM?
Caspian picks the first of 4 routes an app allows: SCIM, then the admin API, then browser automation in a cloud browser, then an Inbox task for a person. An app without SCIM is reached through its API or through browser automation.
| Order | Route | When it is used |
|---|---|---|
| 1 | SCIM | The app and plan support SCIM |
| 2 | API | The app has an admin API integration |
| 3 | Browser automation | No SCIM and no API. Caspian's cloud browser signs in as an admin and makes the change, also with your laptop closed. If that fails, the browser extension in an admin's Chrome does it. |
| 4 | Task | No automated route works. A person gets an Inbox task with the exact steps. |
How do I know a provisioning change worked?
A change counts as done only when Caspian reads the app back and sees the result: the account exists with the right role, or the account is gone or deactivated. If the read-back does not match, the change shows as failed.
Does Caspian remove accounts without approval?
No. In Caspian every removal waits for a person's approval, and the least destructive step comes first, such as deactivating before deleting.
- Removals are never automatic. A person approves each one in "Access beyond the rules".
- Caspian proposes the least destructive step first, such as deactivating before deleting.
- Grants follow the access rules you set per group. Changes to the rules take effect only after you apply them.
- Every action is logged.
What triggers joiner, mover and leaver workflows?
Caspian starts joiner and leaver workflows from the start date or last day in your HR system (HiBob, Personio, BambooHR, Workday or Rippling), or from a new user in your identity provider. A department or role change starts a mover workflow.
| Event | Trigger | What Caspian does |
|---|---|---|
| Joiner | Start date in the HR system, or a new user in the identity provider | Sets up apps, accounts and resources before day one |
| Mover | Department or role change | Adds the new access; proposes removal of the old access for approval |
| Leaver | Last day in the HR system | Removes access from every app, with approval; hands over owned files and objects |
Which systems does Caspian provisioning support?
Caspian connects to 3 identity providers, 5 HR systems and 3 chat apps, plus any SaaS app with SCIM, an API or an admin web interface.
| Type | Supported |
|---|---|
| Identity providers | Google Workspace, Microsoft Entra, Okta |
| HR systems | HiBob, Personio, BambooHR, Workday, Rippling |
| Chat | Slack, Microsoft Teams, Google Chat |
| SaaS apps | Any app with SCIM, an API or an admin web interface |
What does Caspian provisioning not do?
Caspian is not an identity provider and never deletes accounts without approval.
- Caspian is not an identity provider. Sign-in stays with Google Workspace, Microsoft Entra or Okta.
- Caspian does not delete accounts without a person's approval.
- Caspian does not manage SaaS spend or negotiate contracts. It shows unused licences.
How much does provisioning in Caspian cost?
Provisioning is part of Act at €10 per active user per month excl. VAT. See is free: every app, AI tool and laptop, and who has access. Act is €10 per active user per month, excluding VAT, and runs provisioning and offboarding. Act is free for 30 days from install, no card needed, billed monthly, and the price is locked for the first year. See pricing.
Start for free. Self-serve, no card needed. Or add Caspian to Slack, Teams or Google Chat.
What does Caspian read, and with which rights?
Caspian reads metadata and settings, not content. It reads which apps exist, who has an account, which role that account has, and the state of each laptop. It does not read file contents, email bodies or chat messages. Connections are read-only by default; Caspian asks for write rights only for the steps you switch on, such as removing a leaver's account. Customer data is stored with AWS in the EU (Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress.
Simon Mestdagh, founder of Caspian, wrote this page. We make Caspian, one of the tools discussed here.
FAQ
Do my apps need SCIM?
No. SCIM is one of four routes. Apps without SCIM are reached through their API, through browser automation, or through a task.
How do I know a change worked?
Caspian reads the app back after each change. A change shows as done only when the app confirms it.
Can Caspian remove an account on its own?
No. Each removal waits for a person's approval.
What starts a joiner or leaver workflow?
The HR system's start date or last day. Supported: HiBob, Personio, BambooHR, Workday and Rippling.
Does Caspian replace Okta?
No. Caspian is not an identity provider. It replaces the provisioning and lifecycle work, and sign-in stays where it is.
