Hi everyone. We're a small SaaS company (about 25 people) and we recently made the switch from Okta to Cloudflare Access for our internal application gateway. The main drivers were cost and simplicity – setting up a new app behind Access is incredibly fast, and the pricing was a lot easier to swallow.
Overall, we're happy with the core function. The user experience for our team is clean, and having everything behind our domain with the same login flow is great. But we've hit one pretty big snag: the lack of SCIM (System for Cross-domain Identity Management) provisioning.
With Okta, when we onboarded or offboarded someone, their access to *all* the connected apps was handled automatically. Now, our IT person has to manually add/remove users in the Cloudflare dashboard for each application. It's not a huge burden at our size, but it feels like a step backwards and I'm worried about it as we grow. We also miss the automated group sync for role-based access.
Has anyone else made this switch and dealt with the SCIM gap? Are there workarounds we're missing, maybe using the API? Or is this just the trade-off for the simpler, more affordable system? Would really appreciate any insights from teams who've been down this road.
Hey user196 - I run the stack for a B2B SaaS around your size, about 30 people, and we've been through this exact decision. We actually run a hybrid setup now: Cloudflare Access for customer-facing demo portals and some internal tools, but kept Okta for core employee apps because of the provisioning gap you hit.
Based on our side-by-side run, here's the concrete breakdown:
1. **Target audience & fit:** Cloudflare Access is perfect for small teams (under 50) or for specific use cases like contractor portals, where you need a simple, fast gateway. Okta starts making undeniable sense around the 50-person mark when manual user management becomes a real tax. For a 25-person company, you're right on the cusp.
2. **Real pricing:** Okta is ~$6-12/user/month for Workforce Identity depending on your contract and SSO features. Cloudflare Access is ~$4/user/month on the Zero Trust platform, but that's per seat for your *team members who log in*, not your total employee count. The hidden cost is the engineering/IT time you spend on manual provisioning, which at your size might be 1-2 hours a month but grows linearly.
3. **Deployment effort:** Adding a new app behind Access takes about 3 minutes - it's genuinely that fast. Okta setup for a new app can be 15-30 minutes of configuring SAML, attribute mappings, and sometimes testing. The trade-off is that Access simplicity comes from not having a deep directory; it's just a gateway.
4. **The SCIM gap:** This is the real limitation. There is no SCIM provisioning in Access. You can use their API to script user additions/removals per application, but it's not a true sync from a source of truth. We wrote a small script that fires when our HR system sends a webhook (on hire/termination) and it calls the Access API to update a few key apps. It handles about 80% of the work, but it's not a full substitute for Okta's automated group pushes.
5. **Where Access clearly wins:** User experience is cleaner with a unified login domain, and the performance is fantastic because it's on Cloudflare's edge. Latency for our global team dropped noticeably compared to our old Okta-centric flow.
If I had to pick one for you right now, I'd actually recommend staying hybrid if you can. Use Access for the apps where user changes are rare (like your internal wiki or monitoring dashboards), and keep Okta for the high-churn, critical apps (like GitHub, Salesforce, your main SaaS). If you want to go all-in on Access, you need to tell us two things: do you have an HR system that can send webhooks (like BambooHR or Gusto), and is your IT person comfortable maintaining a small Python script or using Zapier? That's the workaround path.
Clean data, happy life.