> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plerion.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SCIM provisioning with Okta

> Configure the Okta SCIM connector to provision Plerion users and user groups automatically

With **Okta SCIM provisioning**, you can have Okta create, update, and deactivate Plerion users as people are assigned to and removed from your Plerion application, and push Okta groups to Plerion as user groups. Okta pushes each change as it happens, so Plerion reflects your directory in near real time.

<Info>
  Before you start, enable SCIM in Plerion and copy the SCIM base URL and a **readWrite** organization API key. See [SCIM provisioning](/guides/administration/scim/overview#steps-to-enable-scim-in-plerion). You also need the SAML application you created in the [Okta single sign-on](/guides/administration/sso/okta) guide, because SCIM provisions users while SAML is used for authentication only.
</Info>

***

## Steps to configure Okta provisioning

<Steps>
  <Step title="Turn on SCIM for the app">
    * Sign in to the Okta admin console and open your Plerion app under `Applications`.
    * On the `General` tab, under `App Settings`, click `Edit`.
    * Set `Provisioning` to **SCIM** and save.

    The app is the one you created earlier for SAML single sign-on. Setting `Provisioning` to **SCIM** adds the `Provisioning` tab you need for the next step.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/ZuAPHuwv74QqOpzR/images/administration/scim/okta-app-settings-scim.jpg?fit=max&auto=format&n=ZuAPHuwv74QqOpzR&q=85&s=ea2d9aa82e3369c5ed3f9e57fac99e5c" alt="Okta app settings with Provisioning set to SCIM" width="2000" height="1106" data-path="images/administration/scim/okta-app-settings-scim.jpg" />
    </Frame>
  </Step>

  <Step title="Configure the SCIM connection">
    * Open the `Provisioning` tab, which shows the `Integration` settings, and click `Edit`.
    * Fill in the connection details:

    | Setting                           | Value                                                                                                            |
    | --------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
    | SCIM connector base URL           | The SCIM base URL you copied from Plerion, under `Admin` > `Security` > `Single sign-on` > `SCIM provisioning`   |
    | Unique identifier field for users | `userName`                                                                                                       |
    | Supported provisioning actions    | Tick **Push New Users**, **Push Profile Updates**, **Push Groups**, and **Import New Users and Profile Updates** |
    | Authentication Mode               | **HTTP Header**                                                                                                  |
    | Authorization                     | Paste a **readWrite** organization API key as the bearer value                                                   |

    * Click `Test Connector Configuration` and confirm it passes, then click `Save`.

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/ZuAPHuwv74QqOpzR/images/administration/scim/okta-scim-connection.jpg?fit=max&auto=format&n=ZuAPHuwv74QqOpzR&q=85&s=841b07947034f3b33ac5ec731cc01e3b" alt="Okta SCIM connection settings with base URL and authentication mode" width="1582" height="1296" data-path="images/administration/scim/okta-scim-connection.jpg" />
    </Frame>
  </Step>

  <Step title="Enable the provisioning actions">
    * Still on the `Provisioning` tab, select `To App` in the left sidebar and click `Edit`.
    * Enable **Create Users**, **Update User Attributes**, and **Deactivate Users**.
    * Click `Save`.

    <Note>
      These three are off by default, and nothing provisions until you enable them. A user you assigned before this shows `Matching user not found`, or a `provision user` task, in Okta until provisioning is enabled and the task is retried.
    </Note>

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/ZuAPHuwv74QqOpzR/images/administration/scim/okta-to-app-provisioning.jpg?fit=max&auto=format&n=ZuAPHuwv74QqOpzR&q=85&s=3f0fe90e5f941374938b839ff0c76d54" alt="Okta To App provisioning settings with create, update, and deactivate enabled" width="2000" height="1331" data-path="images/administration/scim/okta-to-app-provisioning.jpg" />
    </Frame>
  </Step>

  <Step title="Push groups">
    * Open the `Push Groups` tab, click `Push Groups` > `Find groups by rule`, and create a rule that matches the Okta groups whose members should have Plerion access.
    * Each matching group appears in Plerion under `Admin` > `Directory` > `User groups`, where you grant it roles. See [User groups](/guides/administration/user-groups).

    <Frame>
      <img src="https://mintcdn.com/pleriondocs/ZuAPHuwv74QqOpzR/images/administration/scim/okta-push-groups.jpg?fit=max&auto=format&n=ZuAPHuwv74QqOpzR&q=85&s=1c44d4136cf95532d7d0f00d1fbfd16f" alt="Okta Push Groups tab with the Find groups by rule option" width="2066" height="926" data-path="images/administration/scim/okta-push-groups.jpg" />
    </Frame>
  </Step>

  <Step title="Assign people and verify">
    * Go to the `Assignments` tab, click `Assign` > `Assign to Groups`, and assign a pushed group, or assign a test user who belongs to one.
    * In Plerion, go to `Admin` > `Directory` > `Users` and confirm the user appears with the roles their group grants.
    * Sign in as that user through Okta to confirm the end-to-end flow.
  </Step>
</Steps>

<Note>
  Assigning a user, or pushing a profile update, is what provisions them to Plerion. A user who already existed in Plerion with the same email address is adopted rather than created again.
</Note>

***

For the full user lifecycle and the break-glass rules that apply whatever your IdP, see [SCIM provisioning](/guides/administration/scim/overview).