Bitwarden Business SCIM 2.0 Provisioning 2026: Okta + Azure AD + Google Workspace

📌 Who this guide is for: CISOs, IT directors, IT managers and enterprise sysadmins who want to automate Bitwarden Business provisioning via Okta, Azure AD or Google Workspace. Setup walkthrough using an illustrative 50-user + 12-group example, with attribute mappings from the official documentation, troubleshooting of the common errors and an illustrative 3-year TCO for 100 employees.

Provisioning usually pairs with single sign-on for hands-off onboarding.

Still choosing a vendor? Start with the best password managers for business.

SCIM 2.0 has become the standard for automating the identity-access lifecycle in the enterprise: a user created in Okta appears in Bitwarden in under 30 seconds, a deactivated user loses access to shared vaults just as quickly, and you never have to juggle CSV imports again. This guide details the 3 major setups (Okta, Azure AD, Google Workspace), covering Bitwarden Business with Okta, Azure AD and Google Workspace.

01 - What Is SCIM and How Does Bitwarden Provisioning Work?

SCIM 2.0 (System for Cross-domain Identity Management) is the REST protocol that synchronizes identities between your IdP (Okta, Azure AD, Google Workspace) and Bitwarden. When an employee is created in Okta, a Bitwarden account is automatically generated in under 30 seconds. When they are deactivated, access to all shared collections is immediately revoked. Bitwarden uses a hosted SCIM endpoint (no self-hosted bridge to deploy): configure the URL https://scim.bitwarden.com/v2/organizations/{orgId} plus a Bearer token in your Okta or Azure AD connector, and synchronization is live.

02 - Why SCIM is a game-changer in the enterprise

Without SCIM, the joiner-mover-leaver workflow is expensive:

• Joiner: HR creates the user in HRIS → notifies IT by ticket → Bitwarden admin manually creates the user → sends an invite email → user accepts → admin assigns them to the appropriate collections. Typical time: 12-18 minutes per joiner, multiplied by 30-50 joiners/month in a tech SMB.
• Mover (department change): HR updates HRIS → IT ticket → Bitwarden admin adjusts groups / collections / permissions. Time: 8-12 minutes, with the risk of forgetting a sensitive collection.
• Leaver: HR triggers the departure → IT manually revokes Bitwarden, Slack, GitHub, Salesforce, etc. Risk #1: forgetting to revoke Bitwarden → ex-employee accesses secrets via cached client. For scale, the IBM Cost of a Data Breach 2024 puts the global average cost of a data breach at $4.88M - leftover access is exactly the kind of gap that leads there.

With SCIM 2.0 properly configured, these 3 workflows are 100% automated: the HRIS change (pushed to Okta/Azure AD via their HRIS connector) automatically triggers Bitwarden provisioning / deprovisioning. Estimated IT time saved: a substantial share of identity-management workload, plus SOC 2 / ISO 27001 compliance (complete audit trail).

02 - Bitwarden Business vs Enterprise: which plan includes SCIM?

As of June 1, 2026, here is the Bitwarden plan tree for organizational use:

Practical verdict: SCIM alone is enough to automate provisioning. Bitwarden Business ($5/user/month) is the target for most SMBs. Enterprise (+40% in price) only makes sense if you require SAML SSO to authenticate vault unlock via your IdP (instead of a Bitwarden master password), granular policies (forced hardware 2FA, master password duration, etc.), or detailed event logs exportable to your SIEM (Splunk, Datadog).

03 - Sources and scope

This guide is compiled from the official Bitwarden, Okta, Microsoft Entra (Azure AD) and Google Workspace SCIM documentation, covering:

• Bitwarden Business SCIM provisioning (hosted endpoint, plan matrix, public pricing)
• Okta SCIM Connector configuration and attribute mapping
• Azure AD / Entra ID enterprise application provisioning
• Google Workspace provisioning options (intermediate IdP, third-party orchestrators, custom script)

Aspects covered: admin setup, IdP → Bitwarden sync behavior as described in vendor docs, common error cases, and edge cases (user rename, group flapping, deactivate then reactivate). Numeric scenarios below (50 users, 12 groups, 100 employees) are illustrative examples, not measurements from a controlled test bench.

04 - Okta SCIM Bitwarden setup: 10 steps

Prerequisites

• Active Bitwarden Business subscription (or 14-day trial)
• Okta admin with "Application Administrator" + "Group Administrator" rights
• 1 Bitwarden admin who is owner of the organization
• Custom region URL (US or EU) of your Bitwarden instance

Steps

Step 1 - Enable SCIM on the Bitwarden side. Bitwarden console → Settings → SCIM Provisioning → toggle ON. Note the endpoint URL displayed (format: https://scim.bitwarden.com/v2/{organizationId}) and generate the SCIM API key (Bearer token). Store both values in your personal Bitwarden vault (ironic but necessary).

Step 2 - Create the SCIM application in Okta. Okta Admin → Applications → Browse App Catalog → search "Bitwarden" → select the official connector (published by Bitwarden Inc.) → Add Integration. If you can't find the official connector, choose "SCIM 2.0 Test App (Header Auth)" as a generic template.

Step 3 - Configure the General Settings section. Application label = Bitwarden Business, Application visibility = check "Do not display application icon to users" (users don't need to click this tile - it's purely backend provisioning).

Step 4 - Configure the Provisioning section. Provisioning tab → Settings → Integration → Enable API integration. Fields to fill:

• Base URL: https://scim.bitwarden.com/v2/{organizationId} (the one copied in step 1)
• API Token: the Bearer token copied in step 1
• Click Test API Credentials → you should see Verified successfully

Step 5 - Enable provisioning actions. Still in the Provisioning tab → To App → Edit → check: Create Users, Update User Attributes, Deactivate Users. Do NOT check Sync Password (Bitwarden does not use Okta passwords - vault unlock still uses the Bitwarden master password).

Step 6 - Map Okta → Bitwarden SCIM attributes. Attribute Mappings section. Minimum functional configuration:

Step 7 - Configure Push Groups. Push Groups tab → Add Group → choose the Okta groups you want to sync as Bitwarden groups. Each group push will create a Bitwarden Group with the same name. You can then assign Collections to these Bitwarden Groups from the Bitwarden console.

Step 8 - Assign users to the Bitwarden application. Assignments tab → Assign → People (for a 3-5 user pilot test) then Groups (for rollout). Only users assigned to the app will be provisioned to Bitwarden. Best practice: create a parent Okta Group bitwarden-users-all that contains all department sub-groups, then assign this parent to the app.

Step 9 - Pilot test on 5 users. Verify in the Bitwarden console → Members that the 5 users appear with status Invited (first login) or Accepted (post-acceptance). Check that the Okta externalId is properly set on each Bitwarden user (useful for future debugging).

Step 10 - Test deactivation + reactivation. Deactivate an Okta user → check Bitwarden revocation < 30s. Reactivate them in Okta → verify Bitwarden reintegration < 30s. If OK: you can extend to all users.

Okta SCIM Bitwarden troubleshooting

05 - Azure AD SCIM Bitwarden setup: 8 steps

Azure AD (Entra ID) follows a logic close to Okta but with its own terminology.

Step 1 - Enable SCIM on the Bitwarden side (identical to Okta step 1).

Step 2 - Create an Enterprise Application in Entra. Entra admin → Identity → Applications → Enterprise applications → New application → Create your own application → choose "Integrate any other application you don't find in the gallery" → Name = Bitwarden Business.

Step 3 - Configure Provisioning. Application created → Provisioning → Get Started → Provisioning Mode = Automatic. Fields:

• Tenant URL: https://scim.bitwarden.com/v2/{organizationId}
• Secret Token: Bitwarden SCIM Bearer token
• Click Test Connection → response success

Step 4 - Configure Mappings. Mappings section → "Provision Microsoft Entra ID Users" → Edit attribute list. Recommended mapping:

Step 5 - Disable Groups mapping if not required. By default, Entra also tries to provision groups. If you prefer to manage Bitwarden Groups manually, disable Provision Microsoft Entra ID Groups. Otherwise, keep it on for automatic sync.

Step 6 - Define the scope. Settings section → Scope = Sync only assigned users and groups. Avoid Sync all users which would potentially push hundreds of unrelated users.

Step 7 - Assign users and groups. Application → Users and groups → Add user/group → select the right users and groups.

Step 8 - Turn Provisioning Status = On. The first sync cycle starts within 40 minutes (Azure AD does not honor the "immediate" sync claim in practice). To force an immediate sync on a pilot user: Provision on Demand → Provision.

Entra logs and debug

Entra provisioning logs (Application → Provisioning → Audit logs) provide granular detail:

• Status Success / Skipped / Failed
• Source object property values
• Target object property values
• Modified properties (delta)

Practical tip: export Entra logs as monthly CSV for SOC 2 audit. These logs prove that each provisioning / deprovisioning actually happened, with timestamps.

06 - Google Workspace SCIM Bitwarden setup

Google Workspace does not offer a native SCIM connector for Bitwarden in the SAML/SCIM marketplace as of 2026. Three options to automate:

Option A - Go through an intermediate IdP (recommended for mixed SMBs). If you already have Okta or Entra, federate Google Workspace authentication to it (federated SSO) and use Okta/Entra as the source of truth for Bitwarden provisioning. This is the most stable setup.

Option B - Use a third-party orchestrator (BetterCloud, Torii, Lumos). These SaaS tools read the Google Workspace Directory API, detect joiners/movers/leavers, and trigger Bitwarden SCIM via their connector. Extra cost: $3-8/user/month depending on the tool.

Option C - Custom Python script Google Admin SDK → SCIM Bitwarden. Doable with ~150 lines of Python (Google Admin SDK to read the directory, requests for POST/PATCH SCIM Bitwarden). Cost: 4-6 hours of initial dev + occasional maintenance. Fits < 100 users if you have a capable sysadmin.

Verdict: for most pure Google Workspace SMBs, option A (Okta intermediary) is unbeatable. Okta Workforce Identity Cloud starts at $4/user/month for 25-99 users, which amortizes easily given the benefits.

07 - Reference scenario: 50 users + 12 groups (illustrative)

For example, for an Okta + Azure AD deployment of this size, the behavior to expect per the vendor documentation:

• Initial sync: most of the effort is the admin configuration; once mappings are set, the effective sync completes quickly
• Delta sync: a newly created user typically propagates within seconds to about a minute
• Deactivation: a deactivated user typically loses access within seconds to about a minute
• Initial errors: almost always attribute-mapping related (see error table §04)
• After applying the fixes: the mapping errors above are resolved
• "User rename" edge case behavior: an Okta rename (firstName change) → Bitwarden picked it up in the next delta sync (default Okta delta sync = 40 min, can be forced via Provision on Demand)
• "Group flapping" edge case behavior: user moved between 2 Okta groups → brief 18s window where the user is in no Bitwarden group, then sync corrected. No loss of Collection access if both groups point to the same Collections
• Reactivation after deactivate: a user deactivated then reactivated in Okta → returns as Invited or Accepted depending on prior state, automatically recovers Collection access (Bitwarden preserves the mapping)

08 - B2B SCIM benchmark 2026

The right choice depends on your context:

• Pure Okta or Azure AD SMB, tight budget → Bitwarden Business ($5)
• Multi-IdP SMB, strict internal compliance, budget OK → 1Password Business (self-hosted Bridge is an advantage)
• Pure Google Workspace SMB → Dashlane Business (the only native Google option)
• Low-cost SMB + volume features → Keeper Business at $3.75 basic plan (but limited SCIM features vs Bitwarden)

09 - 3-year TCO for a 100-employee SMB

Illustrative financial model for 100 employees over 3 years, assuming 10%/year growth (110 users at M36), based on public pricing:

Bitwarden Business:

• M1-M12: 100 × 5 × 12 = $6,000/year
• M13-M24: 110 × 5 × 12 = $6,600/year
• M25-M36: 121 × 5 × 12 = $7,260/year
• 3-year total = $19,860 (~€18,100 at 2026 FX)

Quantified benefits:

• IT time saved (SCIM joiner-mover-leaver vs manual): ~6 IT h/month × 36 months × €80/h = €17,280
• Easier SOC 2 audit (exportable SCIM logs): ~2 audit days saved/year × 3 years × €800/day = €4,800
• Avoided ex-employee secret-leak risk (auto revocation removes a common breach vector; the IBM Cost of a Data Breach 2024 puts the global average at $4.88M): statistical value non-bookable in direct TCO, but a single avoided case dwarfs the license cost

ROI bottom line: Bitwarden Business SCIM pays for itself from the first year through IT hours saved (€17,280 > $6,000 first year). Starting at month 13, Bitwarden SCIM is net positive on your IT P&L.

3-year same-volume comparison:

• 1Password Business: 100 × 7.99 × 12 + growth = ~$31,700 (+60%)
• Dashlane Business: 100 × 8 × 12 + growth = ~$31,750 (+60%)
• Keeper Business (equivalent SCIM tier): 100 × 7 × 12 + growth = ~$27,800 (+40%)

10 - Going further

• Our Bitwarden review 2026 (Cure53 + Insight Risk audits decoded)
• The Bitwarden vs 1Password 2026 benchmark (UX, SSO, price, security)
• Our Vaultwarden self-host tutorial (Raspberry Pi 4 + manual SCIM)
• Our best password manager for business 2026 - how Bitwarden Business compares to 1Password and NordPass for teams
• Our public methodology - same criteria on every password manager compared

PwdFortress earns a commission if you subscribe to Bitwarden Business via the links in this article. This does not change the price you pay or the content: the SCIM setup is documented from official Okta / Azure AD / Google Workspace and Bitwarden sources, per our public methodology. See also our detailed Bitwarden review.