SCIM is great, if your expectations are sufficiently low. Mostly for the fact that it’s a de-facto industry standard. Have a large stable of software products that your employees use? SCIM lets you provision and, importantly, de-provision users and assign them “groups” (roles) from your centralized Identity Management system. Most IdP’s and software will support SCIM, so it’s just wiring things up.

The biggest oversight when SCIM was designed was the expectation of an inbound connection from the provisioning software (e.g. Azure) to the SAAS or similar. This means that in hybrid environments (e.g. most large enterprises), you are having to whitelist umpteen different ip ranges from the Cloud Provider. Some IdP’s have solved this with a local agent you install on-premise to reverse the connection, but Azure is not one of these.