## Enable Okta for SCIM provisioning

URL: https://docs.atlan.com/product/integrations/identity-management/scim/how-tos/enable-okta-for-scim-provisioning

> Automate Okta user and group lifecycle in Atlan with SCIM 2.0. Provision new users, keep attributes in sync, deactivate leavers, and optionally push groups from Okta to Atlan.

Okta SCIM provisioning automates the full user lifecycle in Atlan: new users are provisioned when assigned to the Atlan app in Okta, attributes stay in sync as they change, and users are deactivated in Atlan when removed from Okta. Start in Atlan to generate a SCIM token, then complete the configuration in the Okta admin console.

## Prerequisites

- **Okta SSO configured for Atlan.** SCIM runs alongside SSO, not in place of it. See [Enable Okta for SSO](https://docs.atlan.com/llms/governance/access-control/enable-okta-for-sso/llms.txt) if you haven't set this up yet.
- **Users assigned to the Atlan SAML app in Okta.** Only assigned users can be provisioned. See the [Assign users and groups](https://docs.atlan.com/llms/governance/access-control/enable-okta-for-sso/llms.txt) section of the SSO guide.
- **Admin access in Atlan** to generate the SCIM token.
- **Administrator access in Okta** to configure the SCIM connection and attribute mappings.
- **For group push:** group mapping must already be configured in Atlan's Okta SSO settings. See [Sync Okta groups to Atlan groups](https://docs.atlan.com/llms/governance/access-control/enable-okta-for-sso/llms.txt).

## Get SCIM token from Atlan

Atlan issues a bearer token that Okta uses to authenticate its SCIM requests. Generate this first, before touching Okta.

1. In your Atlan workspace, click **Settings** from the left menu.

 If you are using the **Old UI (Classic)**, from the left menu, click **Admin**.

2. Click **SSO**, then open your **Okta** provider.

3. Under _Overview_, find **Automate Provisioning with SCIM** and toggle it on.

4. Click **+ Generate token**.

5. Copy the token and store it securely. The token is shown only once. If you lose it, generate a new one.

Your SCIM endpoint URL is `https://<your-tenant-dns>/api/service/scim/`. You will need both the token and this URL when configuring Okta.

## Configure SCIM in Okta

All the Okta-side work happens here: enable SCIM on the app, connect to Atlan, map user attributes, and optionally push groups.

### Enable SCIM on app

SCIM provisioning is off by default on an Okta app.

1. Log in to the Okta admin console and go to **Applications → Applications**.

2. Open your Atlan SAML app.

3. Open the **General** tab and click **Edit**.

4. Under _App Settings_, set **Provisioning** to **SCIM** and click **Save**.

A **Provisioning** tab now appears on the app.

### Connect Okta to Atlan

1. Open the **Provisioning** tab. Under _Settings > Integration_, click **Edit**.

2. Fill in the connection details:

 - **SCIM connector base URL**: `https://<your-tenant-dns>/api/service/scim/`
 - **Unique identifier field for users**: `userName`

3. Under _Supported provisioning actions_, enable all of the following:

 - Import New Users and Profile Updates
 - Push New Users
 - Push Profile Updates
 - Push Groups
 - Import Groups

4. Set **Authentication Mode** to **HTTP Header**.

5. In the **Authorization** field, paste the SCIM token you generated in Atlan.

6. Click **Test Connector Configuration** to verify the connection.

7. Click **Save**.

8. In the Settings left menu, click **To App**, then click **Edit** and enable:

 - **Create Users**: provisions a new Atlan account for each assigned Okta user. If the username already exists in Atlan, Okta links to the existing account rather than creating a duplicate.
 - **Update User Attributes**: keeps Atlan profiles in sync with Okta. Changes made directly in Atlan will be overwritten by Okta profile values.
 - **Deactivate Users**: deactivates Atlan accounts when users are unassigned in Okta or their Okta accounts are deactivated. Accounts are reactivated if the user is reassigned.

9. Click **Save**.

### Map user attributes

Attribute mappings tell Okta which fields to send to Atlan when provisioning or updating a user.

1. In the Okta admin console, expand **Directory** and click **Profile Editor**.

2. Under _Users_, click **Apps** and select the Atlan SAML app.

3. Under _Attributes_, click **Mappings**.

4. In the _User Profile Mappings_ dialog, click **Okta User to App**.

5. `userName` is already set. Define the following additional mappings (Okta attribute → Atlan attribute):

 - `user.firstName` → `givenName`
 - `user.lastName` → `familyName`
 - `user.email` → `email`

6. Click **Save**, then click **Apply updates now**.

Keep in mind:

- Username and email address cannot be changed after a user is provisioned.
- Users who already exist in Atlan must have Okta credentials that match their existing Atlan credentials for provisioning to succeed.

### Push groups to Atlan (optional)

Group push syncs Okta group membership to Atlan so users land in the right teams automatically. Group mapping in Atlan's Okta SSO settings must be configured first. See [Sync Okta groups to Atlan groups](https://docs.atlan.com/llms/governance/access-control/enable-okta-for-sso/llms.txt) before continuing.

1. In the Okta admin console, open your Atlan SAML app and click the **Push Groups** tab.

2. Click **Edit**, then click the settings icon under _Push Groups to App_.

3. Select **Rename app groups to match group name in Okta** and click **Save**.

4. Click **Push Groups** and select **Find groups by name**.

5. Search for and select an Okta group.

6. Under _Match result & push action_, click the **Create Group** dropdown and select **Link Group**.

7. Click **Save**. Repeat for each group you want to push.

## Need help?

If users are not appearing in Atlan after assignment, or are not being deactivated when removed, see [Troubleshooting SCIM provisioning](https://docs.atlan.com/llms/governance/access-control/troubleshooting-scim-provisioning/llms.txt). Contact [**Atlan Support**](https://docs.atlan.com/support/submit-request) if the issue persists.

## See also

- [Enable Okta for SSO](https://docs.atlan.com/llms/governance/access-control/enable-okta-for-sso/llms.txt): The SSO setup SCIM runs alongside.
- [Troubleshooting SCIM provisioning](https://docs.atlan.com/llms/governance/access-control/troubleshooting-scim-provisioning/llms.txt): Common issues and fixes.
- [SCIM provisioning overview](https://docs.atlan.com/product/integrations/identity-management/scim/how-tos/configure-scim-provisioning): When to use SCIM and how it compares to SSO-only.
- [Sync groups from your IdP](https://docs.atlan.com/llms/governance/access-control/automatically-assign-groups/llms.txt): Group sync via SSO login as a lighter-touch alternative.

---