SSO starts at Growth Contractor; SCIM is Enterprise
Decided
Single sign-on is a Growth Contractor feature and SCIM provisioning is an Enterprise one, stated plainly on both the pricing page and /security. The security page previously implied SSO ships on every paid tier.
Alternative: bundle SSO everywhere on the argument — which /security made in as many words — that a security control should not be an upsell.
Why not: the pricing comparison row governs, because it is the one a customer signs against, and the argument for bundling is a commercial position the owner had not taken. Discovering the gate during implementation, after scoping an integration around it, is a worse outcome than reading it on the pricing page.
Two things were kept from the bundling argument rather than discarded with it. Enforcement carries no charge on any plan that has SSO — turning a control on should not cost extra once you already hold it. And the copy now leads with SCIM rather than SSO, because SCIM is the half that matters for the question people are actually asking: it is what makes a termination in the HR system revoke a technician's tablet session within minutes, rather than whenever somebody remembers to mention it.
What would make this wrong: a competitor bundling SSO at entry level and taking deals on it, or a security incident traceable to entry-tier password authentication. Either turns this into a pricing decision to revisit.