> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Okta SCIM Provisioning
> Provision and deprovision members from Okta to StackOne with SCIM.
Sync members from Okta into StackOne with SCIM. Once the two are linked, assigning a person to the StackOne app in Okta provisions them into your organization, and unassigning or deactivating them removes their access.
## Prerequisites
SCIM Provisioning attaches to an existing SSO connection, so set up SSO first.
* An active SSO connection for your organization, with its domain verified. SCIM Provisioning keys on this connection and can't be enabled without it. See [SSO setup](/secure/identity-and-access/authentication/sso/overview).
* The organization **Admin** role in StackOne, which is required to manage provisioning.
* Admin access to your Okta org to configure the app.
Provisioned members and their Okta SSO logins converge on one StackOne account by email, which is why the SSO connection's domain must be verified. Keep provisioning and SSO on the same verified domain.
## Link SCIM in StackOne
Go to **Organization > Security > SSO**, open your connection, and select the **Provisioning** tab. On the **Directory Sync** card, click **Link SCIM** to open the **Directory Sync** panel.
In the **SCIM Details** section, copy the **SCIM base URL** and the **Provisioning token**. The token is shown once. Copy it now, because StackOne stores only a hash of it and can't display it again.
The SCIM base URL ends in `/api/auth/scim/v2`. Copy it from the panel rather than typing it. If the token is ever lost or leaked, reopen the panel with **Edit SCIM** on the **Directory Sync** card, then click **Regenerate** next to the **Provisioning token** and confirm with **Confirm rotate**. Rotating the token swaps the secret only and leaves your provisioned access unchanged, so update Okta with the new token afterward.
On the **Provisioned access** card, select **Manage access**. Choose the projects synced members join and a role for each one (**Viewer**, **Member**, or **Admin**), then click **Save changes**. This access is shared with [JIT provisioning](/secure/identity-and-access/provisioning/jit), and every provisioned user still joins your organization at the **Member** role.
## Configure provisioning in Okta
In your Okta admin console, open the StackOne app you use for SSO and go to the **Provisioning** tab. Click **Configure API Integration** and select **Enable API integration**.
Paste the **SCIM base URL** from StackOne into **SCIM connector base URL**. Set the authentication mode to **HTTP Header** and paste the **Provisioning token** as the bearer token. Click **Test Connector Configuration** to confirm Okta can reach StackOne, then click **Save**.
Under **Provisioning > To App**, click **Edit** and enable **Create Users**, **Update User Attributes**, and **Deactivate Users**. These let Okta create members in StackOne, keep their profiles in sync, and remove access when you unassign or deactivate them.
## Assign members in Okta
Open the **Assignments** tab of the StackOne app and assign the people you want in StackOne. You can assign individuals or Okta groups; in both cases Okta provisions each assigned person into your organization with the default role and projects you set.
Assigning an Okta group provisions its members as individual users. To bring the group itself into StackOne, with its membership kept in step, push it as well. See [Push groups](#push-groups).
Return to the **Directory Sync** card in StackOne. The **Synced members** and **Last synced** values update as Okta pushes users, and new members appear in the projects you selected.
## Push groups
Okta's **Group Push** creates the group in StackOne as a synced group and keeps its members in step. Only members who are assigned to the StackOne app, and so already provisioned, are pushed.
On the app's **Provisioning** tab, under **Integration**, click **Edit** and make sure **Push Groups** is enabled alongside **Push New Users** and **Push Profile Updates**. Click **Save**.
Open the app's **Push Groups** tab, click **Push Groups**, and choose **Find groups by name**. Select the Okta group, leave **Push group memberships immediately** on, and click **Save**. To push several groups that share a naming pattern, choose **Find groups by rule** instead.
Okta creates the group in StackOne. If StackOne already has an empty group with the same name, that group becomes the synced group and keeps its access. See [Prepare the access before you push](/secure/identity-and-access/provisioning/scim/groups#prepare-the-access-before-you-push).
Go to **Organization > Manage Team** and open the **Groups** tab. The group is listed with a **Synced** tag and its pushed members. Assign it to projects from its **Projects** tab.
Okta doesn't support using one group both for app assignment and for Group Push. Assign the app with one group and push a separate group, or the two memberships can fall out of step. See Okta's [App assignments and Group Push](https://help.okta.com/en-us/content/topics/users-groups-profiles/app-assignments-group-push.htm).
To rename the group, rename it in Okta. To stop pushing it, choose **Unlink pushed group** on its row in **Push Groups** and pick whether to delete the group in StackOne as well. If you keep it, it stays a synced group in StackOne until you unlink SCIM Provisioning.
## Next steps
How SCIM provisioning works across identity providers.
Provision members from Microsoft Entra ID instead.
Push your identity provider's groups into StackOne and grant access through them.