Okta (SCIM)

To integrate Okta and SASE, you must have these prerequisites:

  • Administrator access to both Okta and SASE Administrator Portal.

  • Active SASE Okta application configured for Single Sign-On.

Note:
SCIM based user provisioning is available to SASE Enterprise customers only.
Important:

  • If your account previously used a different Identity Provider (IdP), removing that IdP does not remove user-level IdP associations. Users provisioned through the previous IdP retain their former IdP linkage. If you enable Okta SCIM provisioning without first removing these users, they have dual IdP associations. This causes SCIM deactivation and sync failures.

  • Before configuring Okta SCIM, remove all users provisioned through the previous IdP from the SASE console, then reprovision them through Okta. No bulk removal operation is available - remove users individually.

SASE integrates with Okta using SCIM, ensuring automatic user synchronization, profile updates, and streamlined deactivation when users are removed from the Okta SCIM Application.

  1. Log in to your Okta Management Portal.
  2. Go to Applications > Browse app Catalog.
  3. Search and select your application and click Add.
  4. Click Done.
  5. Go to the Provisioning tab and click Configure API Integration.
  6. Select the Enable API Integration checkbox.
  7. In the API Token field, enter the generated token. To get the generated token:
    1. Access the SASE Administrator Portal and click Settings > Identity Providers.

      The Identity Providers page appears.

    2. Click Turn On in the SCIM Integration section.
    3. Click Settings in the SCIM Integration section.
    4. Click Generate Token.
    5. The secret token is generated.
    6. Click Copy Token.
    7. Click Close.
  8. Click Test API Credentials.
  9. Click Save.
  10. Go to Settings > To App.
  11. Click Edit.
  12. Select the checkbox for:

    • Create Users

    • Update User Attributes

    • Deactivate Users

  13. Click Save.
  14. To provision users and groups:
    1. Go to Applications and select your SAML 2.0 application.
    2. Go to Assignments tab.
    3. Click Assign.
    4. Search and select the user name, email id, or group(s) name.
    5. To push groups, click the Push groups tab and select By name.
    6. In the Push groups by name field, enter the group name.
    7. Select the Push group memberships immediately checkbox.
    8. Click Save and Go Back.
    9. Click Done.

    These SAML attributes are supported:

    Application Attribute Identity Bridge Attribute or Literal Value
    email user.email
    given_name user.firstName
    family_name user.lastName
    groups Configured in the app UI. See Group Support section.