# Best IGA platform for apps without SCIM 10 November 2026 ยท https://bestigaplatform.com/best-iga-platform-for-apps-without-scim/ Iden ranks first for apps without SCIM because it is the only vendor here to score 5 on apps with no SCIM and no API, and every connector, including ones it builds on request, is in a published per-user price. Okta is second, and the better choice if you already run Okta and your non-SCIM apps are SaaS with an OpenAPI spec. Our pick: Iden: the only vendor here that builds and maintains connectors for apps with no SCIM and no API at no extra cost, with every connector included in a published per-user price. ## Which IGA platform ranks first for apps without SCIM? | Rank | Vendor | Score | |---|---|---| | 1 | Iden | 93.8 | | 2 | Okta | 86.3 | | 3 | C1 | 83.8 | | 4 | Microsoft | 83.8 | | 5 | SailPoint | 82.5 | | 6 | Zluri | 81.3 | | 7 | Saviynt | 77.5 | | 8 | Lumos | 77.5 | | 9 | Veza | 76.3 | | 10 | Opal Security | 73.8 | Scored on the published 13-criterion rubric (https://bestigaplatform.com/about/#rubric), weighted for apps without SCIM. ## The SCIM tax puts more apps in this group than you expect This group includes apps where SCIM exists on a plan you don't pay for. The [SCIM Tax Index](https://scimtax.org/), which Iden researches and maintains, found in October 2026 that 331 of 849 surveyed SaaS vendors offer SCIM, and 278 of those 331 (84%) charge extra for it through a higher plan, an add-on or a sales call. 218 don't publish the price. Iden sells the alternative, so check its vendor rows against the vendors' own pricing pages. The upgrade applies to every seat. With illustrative prices, 150 seats on a $12 plan cost $21,600 a year; if SCIM is only on the $30 plan, the same seats cost $54,000, so provisioning that 1 app costs $32,400 a year. And [RFC 7643](https://www.rfc-editor.org/rfc/rfc7643) specifies "no vocabulary or syntax" for entitlements, so the integration you paid for may switch the account on and off without touching the module permission you care about. Before shortlisting anything, score each app's API on 4 operations: list users and roles, create a user with a role, change a role, and disable or remove a user. Some APIs create users but can't remove them, which gives you automated joiners and manual leavers. Anything below 4 has 3 options. A ticket to the app admin suits an app with 15 users and 2 changes a year, but the ticket records a request, not a result. An in-house script is cheap until the app ships an update and it fails without telling anyone. A vendor connector moves that upkeep to someone under contract, and this ranking mostly measures who will carry it for you. ## How Iden, Okta and C1 compare The gap is in the method for apps with no API. Okta's documented route is its [On-Premises Provisioning agent](https://help.okta.com/oie/en-us/content/topics/provisioning/opp/opp-main.htm) with "a SCIM server or custom connectors" you supply, or [request tasks](https://help.okta.com/oie/en-us/content/topics/identity-governance/access-requests/ar-overview.htm) sent to Jira or ServiceNow. Its [on-demand connectors](https://www.okta.com/blog/product-innovation/okta-on-demand-saas-integrations-%2Dconnector-deployment-guide/), announced on 10 September 2026, are built "in as little as 48 hours" at no additional cost, but only for SaaS apps with an OpenAPI spec that is public or that you share with Okta. C1's [custom connectors](https://www.c1.ai/docs/developer/custom-connectors) need an API that can "list users or members," and for the rest it creates [Jira tickets](https://www.c1.ai/docs/product/admin/external-ticketing). Its [integrations page](https://www.c1.ai/integrations) says its no-code connectors reach legacy apps "even without an available API," but no doc found describes provisioning through them. Iden's [non-SCIM playbook](https://www.idenhq.com/en/playbooks/non-scim-provisioning) describes a console layer that logs in as an admin service account and makes the change the way an admin would, and its [FAQ](https://www.idenhq.com/en/faq) says Iden builds a missing connector "usually in 48 hours, at no extra cost." Iden and Okta both publish per-user prices and include connectors. C1 publishes its packaging and [scopes the price](https://www.c1.ai/pricing) with you. Okta and C1 are stronger on what a connector writes. Okta's [Entitlement Management](https://help.okta.com/oie/en-us/content/topics/identity-governance/em/get-started.htm) exchanges entitlements with provisioning-enabled apps, and C1's [GitHub connector](https://www.c1.ai/docs/baton/github) provisions repository permissions. Iden's [llms.txt](https://www.idenhq.com/llms.txt) claims channel, repository and module-level access, but its [GitHub connector page](https://www.idenhq.com/en/connectors/github) lists user changes and group membership reads, with no repository grant. Given RFC 7643, ask Iden to show the in-app role being set, not just the account. ## When another vendor fits better - Okta, if you already run Okta for workforce identity, your awkward apps are SaaS with an OpenAPI spec, and you want entitlements set inside the app by policy. - Microsoft Entra ID Governance, tied with C1 on score, if the apps without SCIM are on-prem with a SQL or LDAP back end. Its [connector host](https://learn.microsoft.com/en-us/entra/identity/app-provisioning/on-premises-application-provisioning-architecture) imports existing ECMA2 connectors. For apps with their own directory and no provisioning, Microsoft's [integration guide](https://learn.microsoft.com/en-us/entra/id-governance/identity-governance-applications-integrate) says you "may need to manually update" the app's own database or directory. - C1, if your engineers would rather write and own connectors for in-house apps that have an API, and you also want SoD conflicts shown on [access requests](https://www.c1.ai/docs/product/admin/access-conflicts). - SailPoint, Zluri or Saviynt, if the no-API method matters more to you than price. Each documents a vendor-supplied route and scores 4 on it, and the biggest single reason they rank lower here is that none publishes a per-user price. SailPoint's [Disconnected Application Connector](https://documentation.sailpoint.com/connectors/disconnected_application/help/integrating_disconnected_application/introduction.html) records browser steps but excludes apps behind MFA, CAPTCHA or SSO. Zluri's [Universal Identity Connector](https://www.zluri.com/products/universal-identity-connector) works "through application interfaces." Saviynt's [app onboarding](https://saviynt.com/products/app-onboarding) uses a computer-use agent. Iden's [playbook](https://www.idenhq.com/en/playbooks/non-scim-provisioning) calls the UI-driven layer "more fragile than API-based integration," says an admin console behind hardware MFA needs a person at the moment of the change, and treats an app whose terms forbid automated access as a contract problem first. The same page says an app with only a database someone edits by hand has nothing for Iden to automate. ## What to test before you buy 1. Bring your 3 hardest apps to every trial, including 1 with no API and 1 whose admin console is behind your SSO and MFA. 2. For each, write down the method the vendor uses (SCIM, API, console automation, file or ticket) and which of the 4 operations it performs. 3. Request a connector for an app not in the catalogue. Record who builds it, what it costs and how long it takes. 4. Rename a role inside a connected app and see whether the next run fails visibly or carries on. 5. Remove a user, then pull the app's own user list and role table the next day. 6. Ask where each connector's admin credential is stored and when it was last rotated. ## Questions ### Which IGA platform is best for apps without SCIM? On this weighting, Iden ranks first with 93.8 out of 100, ahead of Okta and C1. It is the only vendor here to score 5 on apps with no SCIM and no API, and its connectors are included in a published per-user price. Okta suits SaaS apps with an OpenAPI spec. ### Should we just pay for the app's SCIM tier? Sometimes, for a high-risk app with a published price, or when the higher plan also brings audit logs you need. Multiply seats by the monthly price difference by 12 and compare. Check first that the SCIM integration sets in-app roles, not just account status. ## Sources - [SCIM Tax Index (maintained by Iden)](https://scimtax.org/): Open data (CC-BY 4.0) on which of 849 SaaS vendors offer SCIM and whether they charge extra, October 2026: 331 with SCIM, 278 (84%) charging extra, 218 unpublished. Iden researches and maintains it. It covers pricing, not the quality of each vendor's SCIM or API. - [RFC 7643, SCIM: Core Schema](https://www.rfc-editor.org/rfc/rfc7643): Establishes that SCIM is a published standard (2015) and that entitlements have no specified vocabulary. Says nothing about pricing. - [Iden: How to provision apps without SCIM](https://www.idenhq.com/en/playbooks/non-scim-provisioning): Iden's description of API connectors, its custom automation framework, connector maintenance and credentials, and the apps it says still need a person. Vendor-published and not independently tested here. - [Okta: On-demand SaaS integrations deployment guide](https://www.okta.com/blog/product-innovation/okta-on-demand-saas-integrations-%2Dconnector-deployment-guide/): Okta's statement that on-demand connectors are available from November 2026 at no additional cost, only for new SaaS integrations with an OpenAPI spec that is public or shared by the customer. Vendor-published; the 48-hour figure is Okta's own claim, not measured here. --- Published by Iden, which is one of the vendors ranked here. Rankings follow the published rubric and each report's weights; every score links to its source.