Okta provisioning

Connect an Okta SCIM 2.0 integration to create, update, and deactivate Sim organization members. Configure single sign-on separately for authentication.

Before you start

• On Sim Cloud, use an Enterprise organization. Use an organization owner or admin account to configure provisioning.
• Verify each provisioned email domain.
• Use an Okta administrator with access to application provisioning.
• Make the Sim deployment reachable by Okta over HTTPS. Self-hosted deployments must meet the SCIM rollout requirements.

Start with a test account and a dedicated group. Provisioned members use a seat and receive workspace access through mappings or existing grants.

Keep an existing SAML or OIDC sign-in integration when adding provisioning. If provisioning uses a separate Okta app, assign the intended users to both apps and map the same account email. App assignment, pushed group membership, workspace access, and permission policy are separate controls; see Plan membership and access.

Choose an integration

SCIM support depends on how the Okta app was created:

See Okta's custom-app SCIM instructions. If the provisioning option is missing, confirm that the feature is enabled for your Okta organization.

Connect a supported custom app

1. In Sim, open Settings → Organization → Single sign-on → Provisioning and enable Enable directory provisioning. Copy Connection → Base URL, choose a token expiry under Tokens, and select Issue token. Copy it before closing the dialog; it is shown once.
2. In the supported Okta app, enable SCIM. For a Classic SAML or SWA app, open General → App Settings → Edit, set Provisioning to SCIM, and save.
3. Open Provisioning → Integration and configure SCIM connector base URL with Sim's Base URL. Set Unique identifier field for users to userName.
4. Enable the supported push actions needed for your deployment: Push New Users, Push Profile Updates, and Push Groups for group-based access.
5. Select HTTP Header authentication. In the Classic custom app's Authorization field, enter Bearer <your-sim-token>. This is a Sim-issued token, not an Okta API token. Other creation experiences may label the credential field differently.
6. Test and save the connection. Under Provisioning → To App, enable user creation, attribute updates, and deactivation. Leave password synchronization disabled.

Use an application username and primary email in a domain verified by Sim. If Okta usernames differ from email addresses, review the attribute mappings before assigning members. Then complete the lifecycle and group checks below.

Evaluate with the Header Auth Test App

These steps use Okta's private SCIM template guide. The screenshots show the Test App configuration.

1. 1

   Enable provisioning in Sim

   Open Settings → Organization → Single sign-on → Provisioning and enable Enable directory provisioning. Copy Connection → Base URL. Under Tokens, choose an expiry and select Issue token. Copy the token before closing its dialog.

2. 2

   Add the evaluation app

   In Okta, open Applications and Resources → Applications → Browse App Catalog. Search for SCIM 2.0 Test App (Header Auth), select Add Integration, and name it, for example Sim provisioning evaluation.

   For a provisioning-only app, hide its icon from members and turn off automatic sign-in from the landing page. Under Sign-On Options, choose Secure Web Authentication, use your Sim HTTPS login URL, and set Application username format to Email. Complete setup. These template options do not configure Sim SSO.

3. 3

   Configure API integration

   Open Provisioning → Integration → Configure API Integration and select Enable API integration.

   Field	Value
   Base URL	Sim's HTTPS URL ending in /api/scim/v2
   API Token	Bearer <your-sim-token> — include the prefix and a space

   Select Test API Credentials, then save. The Header Auth template sends API Token as the complete Authorization header. Entering the token alone produces A bearer token is required.

   

   A successful credential test confirms connectivity and authentication. Assign a test account to verify provisioning itself.

4. 4

   Enable provisioning actions

   Under Provisioning → To App → Edit, enable Create Users, Update User Attributes, and Deactivate Users, then save. Leave Sync Password disabled; Sim does not synchronize passwords through SCIM.

   Use a verified-domain email for both the application username and primary email. Review mappings if Okta usernames differ from email addresses.

   

Verify the user lifecycle

1. Assign a test account from Assignments. Confirm it appears in Sim's organization and Provisioning → Activity shows successful requests.
2. Update Display name in Okta and confirm the change in Sim. Sim uses mapped displayName, falling back to the structured name when omitted.
3. If the account belongs to a pushed group, remove it from that group and confirm the downstream removal before unassigning the app.
4. Unassign the account and confirm Sim marks it deactivated.
5. Reassign it and confirm the existing member becomes active again.

Okta sends deactivation, not SCIM user DELETE. Sim suspends access while retaining organization membership, ownership, and the seat. Removing organization membership is a separate offboarding action. See Sim deactivation behavior and Okta's offboarding order.

Push groups and verify access

Use separate groups for app assignment and Group Push; Okta does not support using the same group for both. Assign accounts to the app first.

For example, use Sim users to assign the app and Finance as the pushed group. Create a dedicated permission group in Sim with the restrictions and workspace scope Finance members need. A pushed directory group does not create that policy or its workspaces.

1. Under Push Groups → Find groups by name, select the group.
2. Leave Push group memberships immediately enabled. For a new downstream group, save with Create Group selected.
3. In Sim, open Single sign-on → Provisioning → Group mappings. Add a Workspace mapping at the intended level and a Permission group mapping to the policy created above. A permission-group mapping alone does not grant workspace access. You can also map the organization admin role when that is intended.
4. To match policies automatically, enable Provisioning rules → Manage rules → Match permission groups by name. The pushed name must exactly match an existing non-default Sim permission group, including case. Select Reconcile now for groups already synced. Workspace access still needs its own mapping or existing grant.
5. Confirm a test member gains workspace access and the expected policy restrictions. Remove it from the pushed group while keeping its app assignment, then verify both directory-grant withdrawal and the fallback policy on any workspace it can still access. Add it back and verify access returns without another account being created.

With Lock managed membership enabled, Sim blocks manual invitations and grants for provisioned members. Read How access is withdrawn before mapping groups that overlap existing manual access.

Rotate a token

Issue a replacement token in Sim while the current one remains active. Update the chosen integration's credential field. For the Header Auth template, replace Provisioning → Integration → API Token with Bearer <new-token>.

Test credentials, save, and confirm a successful provisioning request before revoking the old token. Sim allows two active tokens for overlapping rotation.

Troubleshooting

Use View Logs in the Okta app and Provisioning → Activity in Sim. Invalid or revoked tokens appear only in Okta because Sim cannot associate them with a connection.

Related docs

• Directory provisioning
• Single sign-on
• Verified domains