> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trysela.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta SCIM Provisioning

> Provision and deprovision Sela users and groups from Okta using SCIM 2.0.

Use this guide to manage Sela users and groups from Okta. SCIM provisioning uses a
separate Okta application from the OIDC application used for
[single sign-on](/okta%20integration).

<Warning>
  Treat the SCIM bearer token like a password. Store and share it only through an
  approved secrets manager. Never send it through ordinary email or include it in
  a support ticket.
</Warning>

## Before you begin

Ask your Sela contact for:

* Your **SCIM Base URL**
* Your **SCIM Bearer Token**

You also need Okta administrator access that allows you to add applications and
assign users and groups.

## Configure SCIM

<Steps>
  <Step title="Add the SCIM application">
    In Okta Admin:

    1. Open **Applications → Browse App Catalog**.
    2. Search for **(OAuth Bearer Token) Governance with SCIM 2.0**.
    3. Select the application and click **Add Integration**.
    4. Set **Application label** to `Sela SCIM`.
    5. Enable **Do not display application icon to users**.
    6. Disable **Browser plugin auto-submit**.
    7. Click **Next**, then **Done**.

    This application handles provisioning only. Do not replace or modify your
    existing Sela OIDC application.
  </Step>

  <Step title="Connect Okta to Sela">
    Open the new **Sela SCIM** application, then:

    1. Open **Provisioning → Integration**.
    2. Click **Configure API Integration**.
    3. Enable **API Integration**.
    4. Enter the **SCIM 2.0 Base URL** provided by Sela.
    5. Enter the **OAuth Bearer Token** provided by Sela.
    6. Click **Test API Credentials**.
    7. After Okta reports a successful connection, click **Save**.

    Enter the Base URL exactly as provided, without adding a trailing slash.
  </Step>

  <Step title="Enable user provisioning">
    Open **Provisioning → To App**, click **Edit**, and configure:

    * **Create Users:** enabled
    * **Update User Attributes:** enabled
    * **Deactivate Users:** enabled
    * **Sync Password:** disabled
    * **Set password when creating new users:** disabled

    Click **Save**.
  </Step>

  <Step title="Keep only required mappings">
    Under **Provisioning → To App → Attribute Mappings**, keep the mappings that
    send these required values:

    * **User name**
    * **First name**
    * **Last name**
    * **Primary email**

    Keep the system-managed **external ID** and **active status** fields if Okta
    displays them. Remove every other optional mapping unless Sela has asked you
    to provision that attribute.

    In particular, remove these default type mappings if they are present because
    they can cause user update requests to fail:

    * **Primary email type**
    * **Primary phone type**
    * **Address type**
  </Step>

  <Step title="Assign users and groups">
    Open the **Assignments** tab and assign the people or groups that Okta should
    provision into Sela.

    Users who need to sign in must also be assigned to the separate Sela SSO
    application. Assigning a group to the SCIM application provisions its users,
    but does not push the group object itself.
  </Step>

  <Step title="Push groups">
    To provision group objects and memberships:

    1. Open the **Push Groups** tab.
    2. Select **Push Groups → Find groups by name**.
    3. Choose the group to send to Sela.
    4. Confirm the match and click **Save**.
    5. Repeat for each group Sela should receive.
  </Step>
</Steps>

## Verify the integration

Start with one test user and one test group before assigning production users:

1. Assign the test user to the **Sela SCIM** application.
2. Confirm the assignment reaches a provisioned state in Okta.
3. Ask your Sela contact to confirm that the user and pushed group arrived.
4. Update the user's first or last name and confirm the update is synchronized.
5. Unassign the user and confirm that the user is deactivated in Sela.

## Troubleshooting

### Test API Credentials returns 401

Re-enter the bearer token. If the token was lost or rotated, ask Sela for a new
token.

### Test API Credentials fails with the correct token

Confirm that the SCIM Base URL has no trailing slash and was copied exactly as
provided.

### Users are not provisioned

Confirm that **Create Users** is enabled and that the user is assigned to the
SCIM application.

### User updates fail

Confirm that **Update User Attributes** is enabled and remove the three type
mappings listed above. Also confirm that all required mappings remain configured.

### Groups do not appear

Assigning a group to the application provisions its users but does not push the
group object. Configure the group separately under **Push Groups**.