Updated 4 November 2026 by Simon Mestdagh, founder of Caspian.

Key takeaways

• 7 in 10 SaaS apps charge an enterprise tax for automatic offboarding; only 7 in 100 include it.
• Of the 99 apps in this index with a clear answer, 71 (72%) offer SCIM only on an enterprise or top tier, as a paid add-on or above a seat minimum.
• 21 (21%), including Zendesk, GitBook and Aircall, have no SCIM at all.
• Only 7 (7%), including Dropbox, PagerDuty and Gong, include SCIM on the lowest team plan.
• Across the 8 apps that gate SCIM and publish both prices, the SCIM plan costs a median 264% more than the plan teams buy.

SCIM status (99 of 122 apps with a clear answer, checked 4 Nov 2026)	Apps	Share	Examples
Enterprise or top tier, paid add-on or seat minimum	71	72%	Slack, Notion, Linear, Miro
No SCIM at all	21	21%	Zendesk, GitBook, Aircall
Included on the lowest team plan	7	7%	Dropbox, PagerDuty, Gong

Short answer: disabling someone in Google Workspace or Okta does not remove them from every app. Of the 99 apps in this index with a clear answer, 21 have no SCIM at any price, and 71 more sell it only on an enterprise or top tier, as an add-on or above a seat minimum, which most 100 to 250 person companies never buy. For those apps, a person has to remove the leaver by hand. This page lists where to click in each one, and what the removal leaves behind.

Data checked on 4 November 2026. Download the CSV: apps-without-scim.csv.

What is SCIM provisioning?

SCIM (System for Cross-domain Identity Management) is an open standard, defined in RFC 7643 and RFC 7644, that lets an identity provider such as Okta, Microsoft Entra or Google Workspace create, update and deactivate user accounts in another app. With SCIM provisioning on, a new hire gets an account in each connected app when they join, and a leaver's account is deactivated when they are disabled in the identity provider. Nobody logs in to each app to do it by hand.

SCIM only works where the app supports it, and many apps put it on their most expensive plan. SCIM also stops at the account: it does not move a leaver's files, channels or repos to a new owner, and it does not touch the laptop. The rest of this page is about the apps where SCIM does not reach on the plan you pay for.

Which lists already track the SCIM tax?

Three open lists already track which apps charge for SCIM or SSO: the SCIM Tax Index by Iden (849 vendors), the StitchOps SCIM tax (286 apps) and sso.tax. Use them for pricing:

• The SCIM Tax Index by Iden: 849 vendors, CC-BY 4.0. 331 offer SCIM, and 278 of those charge extra for it.
• The SCIM tax by StitchOps: 286 apps. 68 offer no SCIM at any price. The SCIM plan costs a median 2.1 times the plan most teams buy.
• sso.tax, the original wall of shame for SSO pricing.

This page covers the part those lists leave open: what you do on a leaver's last day in the apps SCIM does not reach.

How many apps have no SCIM?

Of the 122 apps in this index, 99 have a clear answer. The rule: an app counts as clear when its SCIM status, as the vendor or the named dataset states it, is gated (only on a higher tier, an add-on or above a seat minimum), none, or included on the lowest team plan. The other 23 are left out of the shares: 5 partial (SCIM for only some identity providers, a separate product, or one direction, such as an HR system that sends but does not receive), and 18 unpublished (SCIM supported with no plan named, not on the page we read, or not checked).

• 71 apps (72%) offer SCIM only on an enterprise or top tier, as a paid add-on, or above a seat minimum.
• 21 apps (21%) have no SCIM at all, including Zendesk, Dropbox Sign, GitBook, Aircall and the HR systems (BambooHR, Personio), which are sources for your directory, not targets.
• 7 apps (7%) include SCIM on the lowest team plan, including Dropbox, PagerDuty and Gong.
• 264% median price increase from the plan teams buy to the plan with SCIM, across the 8 apps that gate SCIM and publish both prices (GitHub 425%, Figma 463%, Intercom 355%, Sketch 267%, 1Password 260%, Apollo.io 143%, Whimsical 100%, Zoom 29%). Eight apps is a small sample.

What goes wrong when you remove a leaver from apps without SCIM?

Removing a leaver by hand leaves something behind in at least 9 of these apps: GitBook keeps the seat, Dropbox Sign loses unsent documents, Zendesk tickets fall back to the group, and BambooHR keeps self-service access for up to 24 months.

• GitBook: removing the user in your identity provider blocks sign-in but keeps the GitBook account and seat. GitBook's own docs tell you to remove them in GitBook too.
• Dropbox Sign: a separate product from Dropbox, so Dropbox SCIM does not cover it. Transfer documents and templates before you remove the member, or you lose access to them.
• Zendesk: reassign open tickets, downgrade the agent to end user, then delete. Skip the reassignment and tickets fall back to the group.
• Aircall: no suspend state. Removal is a permanent delete; recordings stay with the phone line.
• Culture Amp: with an SFTP import, users missing from the file stay active. Only an explicit end date deactivates them.
• BambooHR: former employees can keep self-service access for up to 24 months after termination unless you revoke it.
• Typeform: removing someone from a workspace keeps their seat. Remove them from the organization.
• ChatGPT Business: has no SCIM at all; it joins SCIM only when the same tenant also has ChatGPT Enterprise.
• Adobe Creative Cloud: native SCIM exists only on Enterprise, and only for Entra ID and Google Workspace. Okta customers sync another way.

Where do I click to remove a leaver in each app?

The table below gives the admin click path for 17 of the 122 apps, with each app's SCIM status and the price uplift to the SCIM plan where the vendor publishes both prices. The CSV has all 122.

App	SCIM status	Plan teams buy	Plan with SCIM	Uplift	How to remove a leaver
Zendesk	No official SCIM	not checked	none	n/a	Admin Center > People > Team members > Manage in Support: reassign tickets, set to End user, delete
Dropbox Sign	No SCIM	Essentials	none	n/a	Admin console > Users > Remove, transfer documents first
GitBook	No SCIM (SAML JIT)	not checked	none	n/a	Settings > Members > Actions > Remove member
BambooHR	HR source	Core	none	n/a	Profile cog > End Employment
Culture Amp	HRIS sync only	not checked	none	n/a	Deactivate, or send an End Date from the HRIS
Aircall	No native SCIM	not checked	none	n/a	Users and Teams > All users > Delete
Mailchimp	No native SCIM	not checked	none	n/a	Account & billing > Settings > Users > Revoke Access
Typeform	Not published	Plus	not published	n/a	Admin settings > Members > Remove from organization
Adobe CC	Partial	CC for Teams	Enterprise (quote)	not published	Admin Console > Users > remove, reclaim license
Claude Team	Gated	Team	Enterprise (quote)	not published	Organization settings > Members > Remove from team
ChatGPT Business	Gated	Business	Enterprise (quote)	not published	Workspace settings > Members > remove
GitHub	Gated	Team $4	Enterprise $21	425%	Org settings > People > Remove
Figma	Gated	Professional $16	Enterprise $90	463%	Admin > Members > remove
Intercom	Gated	Essential $29	Expert $132	355%	Settings > Teammates > remove
1Password	Gated	Teams Starter $2.50	Business $8.99	260%	Admin console > People > suspend or remove
Zoom	Gated	Pro $14.16	Business $18.33	29%	User Management > Users > deactivate
Dropbox	Included	Standard $15	Standard $15	0%	Admin console > Members > delete, transfer files

Prices are US list prices per user per month on annual billing, from each vendor's pricing page. The CSV has all 122 apps, with removal steps for nearly all of them, source links, removal effects and notes. Cells we could not confirm on a vendor page say "not published", "not captured" or "not checked".

How was this index built?

We checked 122 apps against vendor docs on 4 November 2026. About a dozen rows rest on Stitchflow or StitchOps data instead of a vendor page, and say so in their status or notes. "Not checked" means we did not check it. The list covers the tools we see most at Mac-first scale-ups of 100 to 250 people, plus the no-SCIM apps from the StitchOps dataset.

• App list: the tools we see most at Mac-first scale-ups of 100 to 250 people, plus the no-SCIM apps from the StitchOps dataset that those companies use.
• Sources: vendor pricing pages, help centres and API docs, read on 4 November 2026. Where only a third party had the fact, the notes column names it.
• SCIM status: "No SCIM" means no SCIM on any plan. Sign-in time account creation (JIT) does not count. "Gated" means SCIM only on a higher plan or add-on.
• Uplift: (SCIM plan price / plan teams buy price) minus 1, only where the vendor publishes both.

How do you offboard a leaver from an app without SCIM?

You have three options for an app SCIM does not reach: remove the leaver by hand, pay for the SCIM plan (a median 264% more across 8 apps), or script the admin's own clicks with a tool such as Caspian at €10 per active user per month.

1. Do it by hand from the steps above, and keep a record of who did it and when.
2. Pay for the SCIM plan, where one exists and the uplift is worth it.
3. Script the admin's own clicks. Caspian runs the same steps an admin would take in the app's admin page, as a browser script you can read before it runs. Each run logs what it did, so the leaver's removal shows up in your audit trail, not in a screenshot. It works on the plan you already pay for. Act costs €10 per active user per month excl. VAT, every laptop of that person included.

Start for free

Disclosure and corrections

We make Caspian, which removes leavers from apps without SCIM. That is why we built this list. The data stands on its own: every row links to the vendor page it came from.

Vendors: if a row is wrong or out of date, email simon@getcaspian.io with a link to your pricing or docs page and we will update it within a week.

What does Caspian read, and with which rights?

Caspian reads metadata and settings, not content. It reads which apps exist, who has an account, which role that account has, and the state of each laptop. It does not read file contents, email bodies or chat messages. Connections are read-only by default; Caspian asks for write rights only for the steps you switch on, such as removing a leaver's account. Customer data is stored with AWS in the EU (Frankfurt). An independent pen test is planned, and ISO 27001 and SOC 2 are in progress.

Simon Mestdagh, founder of Caspian, wrote this page. We make Caspian, one of the tools discussed here.

← All resources