Administrators · SCIM and directory
SCIM provisioning with Okta, step by step
Okta can send your organization's people and groups over SCIM 2.0. Okta's screens change over time; also follow Okta's current documentation.
Before you start
Create a token with both scopes under «Manage» › «SCIM tokens» and keep the «Tenant URL» and the «Secret token» at hand. See SCIM tokens.
Step 1: create the integration
In Okta, create an app integration with SCIM 2.0 provisioning.
Step 2: connect it to the service
| Okta field | Value |
|---|---|
| SCIM connector base URL | The «Tenant URL» (https://<organization address>/scim/v2) |
| Unique identifier field for users | userName |
| Supported provisioning actions | Push New Users, Push Profile Updates, Push Groups |
| Authentication Mode | HTTP Header, with the «Secret token» as the Bearer value |
Test the connection.
Step 3: To App actions
Under To App, enable Create Users, Update User Attributes and Deactivate Users.
Step 4: assign and push groups
- Assign the people to the application.
- Under Push Groups, push the groups you want to use in policies.
Check
People appear under «Manage» › «Users» and groups under «Manage» › «Groups». Deactivating a person in Okta suspends them here and ends their sessions.
Problems
| Symptom | Cause |
|---|---|
| 401 on every request | Wrong, expired or revoked token |
| 403 when creating people | No seats left in the licence, or a token without the scim:users scope |
| Error renaming or re-enabling an administrator | SCIM does not change accounts an administrator promoted to administrator |
See SCIM behaviour.
Error codes in this article
Was this page helpful?
Thank you. Your answer stays in this browser; nothing is sent.
Sorry about that. Try:
- searching for the exact text of the message or the error code
- the error code index
- asking your organization's administrator