Explore documentation
Okta SCIM setup instructions
In this guide, you're going to learn how to turn on SCIM provisioning, for automatic user provisioning and profile synchronization from Okta to Better Stack.
Prerequisites
User Provisioning using SCIM requires a working Single Sign-On (SSO / SAML) setup with Okta.
Follow the SAML setup instructions guide to learn how.
Supported features
- Create users
- Update user attributes
- Deactivate users
- Sync password
- Group push
- Import users & import user groups
Configuration steps
Setting up SCIM after you finished the SSO walkthrough should be very straightforward. Here are the instruction steps:
In the Better Stack Okta SSO settings, click on the Enable provisioning toggle.
Copy the Bearer token value that appears on the page.
Switch to the Okta dashboard, open the Better Stack application, and switch to the Provisioning tab.
Select Email as the Application username format.
Paste the copied Bearer token to the respective field in the Provisioning tab.
Click Save.
While still on the Provisioning tab, next to Provisioning to App click Edit.
Next to Create Users, check Enable
Next to Update User Attributes, check Enable
Next to Deactivate Users, check Enable
Next to Sync Password, check Enable
Click Save.
SCIM user provisioning is turned on, and the setup is now complete. When you want to send your users to Better Stack, simply assign them to the Better Stack application in your Okta organization, and they will sync automatically.
We also support pushing your user groups from Okta - each group will create a new team in Better Stack, along with the assigned Okta users. Note that when you deprovision a Okta Group from the Better Stack Okta application, we delete the Better Stack team as well as any resources. It's important to tread carefully, to make sure you don't lose any configuration or data.
Troubleshooting
When you inactivate or remove a user from the SCIM integration in Okta, we automatically remove them from your Better Stack organization. Note that if the user already belongs to a different organization, their account is not deleted completely - they are only detached from your organization and all the relevant teams. When you re-connect the user via SCIM, they are simply re-added again.