SCIM provisioning from Okta

This builds on an existing Okta app integration — set up SAML sign-in first if you haven't, then add provisioning to the same app.

First, in Settings → Organization here, generate a provisioning token under Automatic provisioning and copy the SCIM base URL and bearer token — the token is shown once.

1. On your Okta app integration, open the Provisioning tab and choose Configure API Integration.
2. Paste our SCIM base URL as the connector base URL, choose email as the unique identifier field, and select HTTP Header authentication with your bearer token.
3. Test the configuration — Okta checks our ServiceProviderConfig endpoint and confirms the token works.
4. Under Provisioning to App, enable Create Users, Update User Attributes, and Deactivate Users.
5. Assign your people (or groups) to the app.

From then on, assignment in Okta creates the account here — verified, enrolled, occupying a seat — and unassignment or deactivation in Okta deprovisions it, with the person's account and certificate kept on record per our deprovisioning policy. If a creation fails because your seats are full, Okta shows the error on the assignment and retries after you add seats.