Skip to main content

Enable Okta for SCIM provisioning

Connect docs via MCP

Okta SCIM provisioning automates the full user lifecycle in Atlan: new users are provisioned when assigned to the Atlan app in Okta, attributes stay in sync as they change, and users are deactivated in Atlan when removed from Okta. Start in Atlan to generate a SCIM token, then complete the configuration in the Okta admin console.

Prerequisites​

  • Okta SSO configured for Atlan. SCIM runs alongside SSO, not in place of it. See Enable Okta for SSO if you haven't set this up yet.
  • Users assigned to the Atlan SAML app in Okta. Only assigned users can be provisioned. See the Assign users and groups section of the SSO guide.
  • Admin access in Atlan to generate the SCIM token.
  • Administrator access in Okta to configure the SCIM connection and attribute mappings.
  • For group push: group mapping must already be configured in Atlan's Okta SSO settings. See Sync Okta groups to Atlan groups.

Get SCIM token from Atlan​

Atlan issues a bearer token that Okta uses to authenticate its SCIM requests. Generate this first, before touching Okta.

  1. In your Atlan workspace, click Settings from the left menu.

    If you are using the Old UI (Classic), from the left menu, click Admin.

  2. Click SSO, then open your Okta provider.

  3. Under Overview, find Automate Provisioning with SCIM and toggle it on.

  4. Click + Generate token.

  5. Copy the token and store it securely. The token is shown only once. If you lose it, generate a new one.

Your SCIM endpoint URL is https://<your-tenant-dns>/api/service/scim/. You will need both the token and this URL when configuring Okta.

Configure SCIM in Okta​

All the Okta-side work happens here: enable SCIM on the app, connect to Atlan, map user attributes, and optionally push groups.

Enable SCIM on app​

SCIM provisioning is off by default on an Okta app.

  1. Log in to the Okta admin console and go to Applications → Applications.

  2. Open your Atlan SAML app.

  3. Open the General tab and click Edit.

  4. Under App Settings, set Provisioning to SCIM and click Save.

A Provisioning tab now appears on the app.

Connect Okta to Atlan​

  1. Open the Provisioning tab. Under Settings > Integration, click Edit.

  2. Fill in the connection details:

    • SCIM connector base URL: https://<your-tenant-dns>/api/service/scim/
    • Unique identifier field for users: userName

  3. Under Supported provisioning actions, enable all of the following:

    • Import New Users and Profile Updates
    • Push New Users
    • Push Profile Updates
    • Push Groups
    • Import Groups

  4. Set Authentication Mode to HTTP Header.

  5. In the Authorization field, paste the SCIM token you generated in Atlan.

  6. Click Test Connector Configuration to verify the connection.

  7. Click Save.

  8. In the Settings left menu, click To App, then click Edit and enable:

    • Create Users: provisions a new Atlan account for each assigned Okta user. If the username already exists in Atlan, Okta links to the existing account rather than creating a duplicate.
    • Update User Attributes: keeps Atlan profiles in sync with Okta. Changes made directly in Atlan will be overwritten by Okta profile values.
    • Deactivate Users: deactivates Atlan accounts when users are unassigned in Okta or their Okta accounts are deactivated. Accounts are reactivated if the user is reassigned.

  9. Click Save.

Map user attributes​

Attribute mappings tell Okta which fields to send to Atlan when provisioning or updating a user.

  1. In the Okta admin console, expand Directory and click Profile Editor.

  2. Under Users, click Apps and select the Atlan SAML app.

  3. Under Attributes, click Mappings.

  4. In the User Profile Mappings dialog, click Okta User to App.

  5. userName is already set. Define the following additional mappings (Okta attribute → Atlan attribute):

    • user.firstName → givenName
    • user.lastName → familyName
    • user.email → email

  6. Click Save, then click Apply updates now.

Keep in mind:

  • Username and email address cannot be changed after a user is provisioned.
  • Users who already exist in Atlan must have Okta credentials that match their existing Atlan credentials for provisioning to succeed.

Push groups to Atlan (optional)​

Group push syncs Okta group membership to Atlan so users land in the right teams automatically. Group mapping in Atlan's Okta SSO settings must be configured first. See Sync Okta groups to Atlan groups before continuing.

  1. In the Okta admin console, open your Atlan SAML app and click the Push Groups tab.

  2. Click Edit, then click the settings icon under Push Groups to App.

  3. Select Rename app groups to match group name in Okta and click Save.

  4. Click Push Groups and select Find groups by name.

  5. Search for and select an Okta group.

  6. Under Match result & push action, click the Create Group dropdown and select Link Group.

  7. Click Save. Repeat for each group you want to push.

Need help?​

If users are not appearing in Atlan after assignment, or are not being deactivated when removed, see Troubleshooting SCIM provisioning. Contact Atlan Support if the issue persists.

See also​