The best user provisioning tools for IT teams, for apps with or without SCIM

The best user provisioning tools for IT teams that run a help desk are Serval, Rippling, Jira Service Management, Freshservice, and ServiceNow, working alongside your identity provider, usually Okta or Microsoft Entra ID. If your hardest provisioning work is the apps your identity provider can't reach, Serval is the strongest fit: each app role gets its own provisioning method, and Serval's AI builder, Catalyst, writes the provisioning and deprovisioning workflows for apps without SCIM against their APIs.

This guide is for enterprise IT and security teams who run Okta or Entra ID and still handle a long tail of access tickets by hand. For the request and approval layer, see our roundup of access request management software.

What should a user provisioning tool do beyond SCIM?

Your identity provider already provisions the apps that support SCIM (we cover where that stops in the hidden gaps in user provisioning automation). The tickets that stay manual are internal tools, GitHub teams, AWS roles, and anything that needs an approval. Look for:

• More than one way to grant access: IdP groups, direct API calls, custom workflows, and a tracked manual task where nothing else works.
• Requests and approvals in Slack or Microsoft Teams, with approvers set per role.
• Removal that matches the grant when access ends or someone leaves.
• Support for the identity providers you run, often Okta and Entra ID side by side.
• A log of every request, approval, grant, and removal.

Comparison: user provisioning tools for IT help desks

The 5 best user provisioning tools for IT teams

1. Serval

Serval is an AI-native ITSM platform, and user provisioning runs through its Access Management. Employees ask for access in Slack, Microsoft Teams, or the Serval portal. An access policy sets who approves, how long access lasts, and whether a justification is required, and Serval grants the role and removes it when time is up.

Each role in an app gets its own provisioning method. Serval can add the user to a group in Okta, Microsoft Entra ID, Google Workspace, Rippling, JumpCloud, or PingOne (or assign a OneLogin role) and let your IdP's SCIM rules do the rest. It can also call the app's API directly where Serval's connector has built-in access provisioning, run a custom workflow, or open a manual task for the person or group you assign. One app can mix them, like app-level GitHub access through an Okta group and Maintainer access on a GitHub team through the GitHub API.

For apps without SCIM, Catalyst builds the provisioning and deprovisioning workflows from plain-English descriptions, against the app's API, and you test them before publishing.

An app outside Serval's catalog can be added as a custom application with its API credentials, then given roles and access policies like any connected app. When time-bound access expires, Serval removes it from the IdP group, calls the app's API, runs the deprovisioning workflow, or opens a removal task for a manual role. Every grant, removal, and approval is logged, and access reviews and license reclamation use the same roles. For onboarding and offboarding, Serval Journeys can start from an HRIS event and raise the access requests that Access Management fulfills (see our onboarding software roundup).

Serval connects to Okta and to Entra ID, and a role can link groups in either. On-premises Active Directory connects over LDAPS or StartTLS, typically through a Serval worker you run inside your network. Serval works with 140+ pre-built integrations, and anything else with an API.

At SeatGeek, an automation that "provisioned access and sent login instructions to end users" handed out 406 Claude licenses with zero human touches. Together AI uses Serval to automate 95% of its just-in-time access requests, and at Abridge, Catalyst is rebuilding the birthright access workflows and access requests for 74 apps as the team moves its IdP to Okta.

2. Rippling

Rippling ties provisioning to its HR record, granting and removing app access through SSO, SCIM, and lifecycle management (Rippling IT). Its identity product lists 600+ pre-built app integrations and custom SCIM integrations. Supergroups grant and remove access based on any employee attribute, and Rippling applies your access rules across provisioning, approvals, license reclamation, and offboarding (Rippling IAM). Developer kits cover custom integrations (Rippling integrations), and its Helpdesk agent handles app access requests through deterministic, admin-approved steps (Rippling Helpdesk).

3. Jira Service Management

Jira Service Management provisions through Jira automation. On Standard, Premium, and Enterprise, its Okta actions can add a user to an Okta group, create, retrieve, or suspend users, and send custom Okta requests (Atlassian). Its Entra ID actions include adding a user to a group, plus custom requests (Atlassian). Request Resolver can carry out a resolution plan on its own, including adding a user to a group in your identity provider, and it uses Rovo credits (Atlassian). For other systems, the Send web request action calls an external service and can pass its response to later steps (Atlassian).

4. Freshservice

Freshservice's Orchestration Center automates user provisioning and deprovisioning through identity apps such as Okta, Azure AD (now Microsoft Entra ID), and Google Workspace (Freshservice), and its Okta app can add and remove users in Okta groups. For apps without an orchestration app, the Web Request node sends API requests from the Workflow Automator to any third-party system with a REST API (Freshservice). Freshworks says its Freddy AI Agent Studio agents handle everyday IT requests end to end across systems, from access provisioning to password resets and device setup (Freshworks).

5. ServiceNow

ServiceNow says its Identity and Access Security automates provisioning, deprovisioning, and access reviews based on effective permissions, lists Lifecycle Management for joiner, mover, and leaver changes, and connects to more than 400 identity systems, cloud platforms, and on-premises applications to see who can access sensitive data (ServiceNow). Its Integration Hub connects apps to ServiceNow through prebuilt spokes that automate actions in business systems, includes a spoke generator for building new spokes, and is now part of Workflow Data Fabric (ServiceNow).

Where do Okta and Microsoft Entra ID fit?

We didn't rank Okta and Entra ID because they're identity providers, not alternatives to the tools above. Serval, Jira Service Management, and Freshservice all provision through them, and your IdP keeps running SSO and SCIM for the apps it supports. Here's what each covers on its own.

Okta

Okta Lifecycle Management provisions accounts through hundreds of pre-built integrations in the Okta Integration Network (Okta). For on-premises apps, the Okta Provisioning Agent lets Okta reach through your firewall to create, update, and deactivate accounts (Okta). Where no pre-built connector exists, Okta Workflows can call a third-party API directly with API Connector cards (Okta Workflows). Okta Identity Governance adds access requests for apps and groups, with approval sequences and access durations, and employees can request access from Slack or Microsoft Teams (Okta).

Microsoft Entra ID

Entra ID provisions apps from its gallery and supports apps that implement the relevant parts of SCIM 2.0 (Microsoft Learn). For on-premises apps that don't speak SCIM, its ECMA Connector Host translates Entra's provisioning requests into requests the target app understands (Microsoft Learn), with connectors for SQL, LDAP, REST, SOAP, and PowerShell (Microsoft Learn). With ID Governance, entitlement management adds access packages with multi-stage approval and time-limited assignments (Microsoft Learn), and Lifecycle Workflows automate tasks across the joiner, mover, and leaver phases (Microsoft Learn). For apps that need manual provisioning, a Microsoft tutorial uses a Logic App to open ServiceNow tickets (Microsoft Learn).

What are the options for apps that don't support SCIM?

There are three main routes, and Serval covers the first two. The first is a call to the app's API, through a built-in connector like GitHub's or a pair of provisioning and deprovisioning workflows that Catalyst builds and you test before publishing. The second, for apps with no API, is a tracked manual task, plus a removal task when temporary access ends. The third is a connector or agent from your identity provider, like Okta's Provisioning Agent or Entra's ECMA Connector Host. The custom provisioning docs walk through the Serval setup.

Can you automate GitHub and AWS access for engineering teams?

Yes. Engineers usually need a GitHub team membership or an AWS role. Serval has built-in GitHub team provisioning for Member and Maintainer roles through the GitHub API. For AWS, Serval grants time-boxed sessions on IAM roles you tag for it, and workflows can create and remove AWS IAM Identity Center account assignments. GitLab group membership can run through a custom workflow that calls the GitLab API.

How do you choose a user provisioning tool?

Choose Serval when your identity provider already provisions your SCIM apps but the tickets that stay manual are apps without SCIM, GitHub teams, and AWS roles. Serval handles those requests, approvals, grants, and removals in the help desk where employees already ask, and Okta or Entra ID stays the source of access.

If you only need SCIM provisioning, your identity provider already covers it. The tools above are for requests, approvals, and apps without SCIM. If HR and IT already live in Rippling, its provisioning sits on the HR record. Jira Service Management and Freshservice can call your IdP from their automation. If you already run SailPoint or Saviynt for identity governance, Serval connects to both.

Frequently asked questions

Which tools automate access provisioning for apps that don't support SCIM?

Serval does it per role: Catalyst builds provisioning and deprovisioning workflows against the app's API, or Serval opens a tracked manual task when there's no API. Jira Service Management and Freshservice can call an app's API from their automation, and identity providers like Okta and Entra ID add their own connectors for on-premises apps.

Which help desk automation tools work with both Okta and Microsoft Entra ID?

Serval connects to both, and roles can add or remove users in Okta groups, Entra security and Microsoft 365 groups, and on-premises Active Directory groups. Jira Service Management and Freshservice also have Okta and Entra ID automation actions.

What adds users to Okta groups automatically when an access request is approved?

In Serval, approving a request for a role with linked groups adds the user to the Okta group, Okta provisions the app, and Serval removes the user when access expires. Jira Service Management and Freshservice can also add users to Okta groups from their automation.

Do we still need Okta or Entra ID if we use Serval?

Serval doesn't replace them. Serval works with your identity provider and changes its group memberships, so the IdP still handles SSO and SCIM. Serval adds requests, approvals, time limits, and provisioning for the apps the IdP doesn't reach.

Which IT automation tools can build integrations for any app with an API?

Serval connects to any app with an HTTPS API as a custom application, and Catalyst can create the app, its roles, and the workflows that call it. Rippling's developer kits, ServiceNow's Integration Hub spoke generator, Jira automation's Send web request action, and Freshservice's Web Request node also connect to custom APIs.