> For the complete documentation index, see [llms.txt](https://docs.siit.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.siit.io/guides/workspace/okta-scim-setup.md).
# Set up SCIM with Okta
SCIM automates user account creation, updates, and deactivation in Siit based on your Okta directory. This guide shows you how to connect Okta to Siit using SCIM.
**What you get:**
* **Automatic admin & agent provisioning:** new admins and agents get Siit access as soon as they're added to your Okta directory
* **Real-time attribute sync** – job titles, phone numbers, and languages stay current
* **Group-to-role mapping** – assign Siit permissions based on your existing IdP groups
* **Instant deprovisioning** – suspended or deleted accounts lose access immediately
Okta SCIM ensures your team's access stays perfectly in sync with your organization's directory, reducing security risks and IT overhead.
**Supported SCIM Features**
The following SCIM provisioning features are supported:
* **Push New Users** – Create users in Siit when assigned in Okta
* **Push Profile Updates** – Update user attributes in Siit when changed in Okta
* **Push Groups** – Push Okta groups to Siit and link them to Siit roles
* **Deactivate Users** – Deactivate users in Siit when removed or suspended in Okta
### What SCIM covers (and what it doesn't)
SCIM provisions **admin and agent accounts only** — it does not manage employee (end-user) accounts.
Employees (requesters) are created automatically in Siit when they first interact via Slack, Microsoft Teams, or email, and their profiles are synced via integrations like Okta People, BambooHR, or Personio.
You do not need to assign all your employees to the Siit Okta app. Only assign users who should have access to the **Siit admin dashboard**.
**Before you begin:**
* Your Siit workspace must be on the Pro plan
* You need Okta admin permissions
1. Install the Siit Application from [Okta Marketplace](https://www.okta.com/integrations/siit/)
2. Go to the SCIM security config in Siit
3. Use the token found there to fill the API key in the provisioning tab in Okta
**💡 Default Role field** While in the provisioning tab in Okta, you'll see a **Default Role** field. This is the Siit role assigned to any SCIM-provisioned user who is *not* explicitly mapped via Push Groups (step 5).
Set this to your most restrictive agent role (e.g. `IT Agent`) to avoid unintentionally granting elevated permissions. Leaving it empty may cause provisioning errors.
4. Assign users
5. Push and link groups
6. Make sure to refresh groups to see existing Siit Roles
7. Go to push groups and choose find by name
8. Link your okta group to an existing siit role
9. Or create role in Siit based on okta group
Roles are now imported and synchronized in Siit
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.siit.io/guides/workspace/okta-scim-setup.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
