Identity as a Service:Sync Okta via SCIM

Enable SCIM

On the Okta application details page, go to the General tab. In App Settings, click Edit, set Provisioning to SCIM, and click Save.

Configure the SCIM connection

1. On the Provisioning tab, in the SCIM Connection section, click Edit and set the following parameters.

   Parameter	Value
   SCIM connector base URL	The SCIM Base URL from Step 1
   Unique identifier field for users	userName
   Supported provisioning actions	Select Push New Users, Push Profile Updates, and Push Groups
   Authentication Mode	HTTP Header
   Authorization	The Bearer Token from Step 1

2. Click Test Connector Configuration. The message Connector Configured successfully confirms a working connection.

3. Click Save.

Configure the user sync policy

1. Go to Provisioning > To App and click Edit next to Provisioning to App.

2. Enable Create Users, Update User Attributes, and Deactivate Users.

3. Configure Sync Password based on your requirements.

   Note

   For password sync to succeed, the Okta password policy must be at least as strict as the IDaaS password policy. For example, if IDaaS requires at least 8 characters including a special character but Okta only requires 6 characters, passwords that don't meet the IDaaS requirements will fail to sync. To set the Okta password policy, go to Security > Authenticators in the Okta Admin Console, find the Password row under Setup, and click Actions > Edit. To set the IDaaS password policy, go to Sign-In > Password Policy > Complexity Rules in the IDaaS console.

   Setting	Behavior
   Disabled	Okta includes a password field when creating the user via SCIM, but sends a randomly generated placeholder — not the user's actual password. This satisfies the SCIM protocol's field requirement but has no effect on login credentials in IDaaS. Users must set their actual password through a separate reset or password policy. For details, see the Okta SCIM 2.0 User Creation and Password Synchronization Guide.
   Enabled — Sync a randomly generated password	Okta generates a random password for each user and syncs it to IDaaS.
   Enabled — Sync Okta Password	Syncs the user's Okta login password to IDaaS, so the user logs in with the same password in both systems.

4. Click Save.

Configure user attribute mapping

Attribute mapping controls which Okta user data gets pushed to IDaaS and how it maps to IDaaS fields.

Synchronize basic attributes

In the Attribute Mappings section on the Provisioning page, click the icon on the far right to remove any attribute mappings you don't need. Keep only the mappings shown in the following figure.

Synchronize custom attributes (optional)

The following example shows how to sync the postalAddress field from Okta to a custom Extended Fields entry in IDaaS named User Address.

1. Add an extended field in IDaaS.

1. In the IDaaS console, go to Account > Field Management > Extended Fields and click Create Field.

2. Fill in the field details.

   Field	Example value
   Field Display Name	User Address
   Field ID	user_address
   Field Type	Input box

3. On the IDaaS application details page, go to Provisioning > Synchronize Application to IDaaS > Show Advanced Settings and configure the following.

   Setting	Value
   Custom Field Namespace	urn:ietf:params:scim:schemas:extension:customfield:2.0:User
   Sync Target Field	User Address (user_address)

4. Click Save.

2. Add an attribute in Okta.

1. On the Okta Profile Editor page, go to the Attributes section and click Add Attribute.

2. Fill in the attribute details.

   Field	Example value
   Display name	User Address
   Variable name	user_address — must match the Field ID in IDaaS
   Data type	string — must match the IDaaS field type
   External name	user_address — must match the Field ID in IDaaS
   External namespace	urn:ietf:params:scim:schemas:extension:customfield:2.0:User — must match the Custom Field Namespace in IDaaS

3. Click Save.

4. In the Attributes section, click Mappings. From the panel, select Okta User To [Target Application Name].

5. At the bottom of the list on the right, find the target attribute (for example, user_address). From the drop-down list on the left, select the Okta field to map from (for example, user.postalAddress).

6. Click Save Mappings, then click Apply updates.

Synchronize users and groups

Synchronize users

1. On the Okta application details page, go to the Assignments tab and click Assign > Assign to People.

2. Find the user to sync and click Assign in the corresponding row.

3. On the Assign [Target Application Name] To People page, adjust attributes as needed, click Save and Go Back, then click Done.

Synchronize groups

1. On the Okta application details page, go to the Push Groups tab and click Push Groups > Find Groups By Name.

2. Enter the group name, select the target group, and click Save. When the Push Status changes from Pushing to Active, the group is synced.

What type of Okta application should I use for SCIM sync?

Select SAML 2.0 when creating the Okta application. This type supports both SAML 2.0 single sign-on and user/group synchronization over SCIM.

How do I trigger Okta user synchronization?

There are three ways sync can happen:

• Automatic: Sync starts when a user is assigned to the IDaaS application in Okta.

• Manual push: Go to the Push Groups tab, select a group, and click Save. The sync starts immediately and the status changes from Pushing to Active.

• Event-driven: When a user's profile changes — such as being added, modified, or deleted — Okta triggers sync automatically based on the Push Profile Updates setting.

Can I delete synced users or groups? What happens if I remove a user's app authorization?

Deleting users or groups in Okta:

If you delete a user or group in Okta, the change syncs to IDaaS according to your configuration. Note that Resource Access Management (RAM) users don't have an enabled or disabled status, so users marked as inactive in Okta are not disabled or deleted in RAM. IDaaS does not support syncing the inactive status from Okta.

Removing app authorization:

If you remove a user's application authorization in Okta, sync stops for that user. The user record in IDaaS is not deleted — it is marked as unauthorized. An administrator must manually remove the user's data (account information, group memberships) from IDaaS.