SCIM Provisioning with Okta
This guide explains how to set up SCIM provisioning between Okta and Descope, enabling Okta to push users, user updates, deactivations, and groups to a Descope tenant.
Prerequisites
- A functional SSO configuration between Okta and Descope must be in place.
- A Descope tenant must be configured with an associated Access Key that includes the
Tenant Adminrole. - Assigned users and groups must exist in the Okta application.
Who gets provisioned is controlled in Okta
Okta only pushes users to Descope if they are assigned to the Okta application (the "Assignments" tab) — either directly or as a member of a group that is assigned. Note that Okta's Push Groups feature (which pushes group objects to Descope via SCIM) is separate from Assignments — being a member of a pushed group does not mean the user is assigned to the app, and only assigned users are provisioned. Similarly, Okta's Group Attribute Statements (SAML) and OIDC group claims, which control what groups are sent in the authentication assertion, are a separate concern again. With JIT disabled, a user who is not assigned cannot log in to your application.
For ongoing onboarding, the recommended pattern is to assign a group to the Okta application rather than assigning users one by one. New employees added to the group are then provisioned automatically. See SCIM Best Practices for the full pattern.
Step 1: Enable SCIM Provisioning in Okta
- Open your Okta application for Descope.
- Go to the General tab.
- Scroll down and check Enable SCIM provisioning.
- Click Save. This will reveal the Provisioning tab.
Step 2: Configure the SCIM Integration
- Go to the Provisioning tab and click Edit in the SCIM Connection section.
- Enter the following values:
| Field | Value |
|---|---|
| SCIM Connector Base URL | https://api.descope.com/scim/v2 |
| Unique Identifier Field for Users | email |
| Supported Actions | Enable: Push New Users, Push Profile Updates, Push Groups |
| Authentication Mode | HTTP Header |
| Authorization Header | Bearer <ProjectID>:<AccessKey> |
The SCIM Connector Base URL can be found in the SCIM Provisioning section under your tenant's SSO configuration in the Descope Console.
- Click Test Connector Configuration. A successful test confirms support for creating users, updating attributes, and group management.
Step 3: Enable Provisioning Actions
In the To App section under Provisioning:
-
Check the following options:
- Create Users
- Update User Attributes
- Deactivate Users
Click Save.
Step 4: Push Groups from Okta to Descope
- Go to the Push Groups tab in your Okta app.
- Select groups to push to Descope.
- These groups will be interpreted as Descope Roles and can be used for access control in flows and session-based policies.
For additional details on role mapping, see the SSO Group Mapping Guide.