# Okta SCIM setup instructions

Set up SCIM for automatic user provisioning and profile synchronization from Okta to Better Stack.

## Prerequisites

User provisioning using SCIM requires a working Single Sign-On (SSO) setup with Okta. Follow the [SAML setup instructions](https://betterstack.com/docs/uptime/okta-sso/saml-setup-instructions/) if you haven't already.

## Supported features

-   Create users
-   Update user attributes
-   Deactivate users
-   Sync password
-   Group push
-   Import users and groups

## Configuration steps

1.  In your [Okta SSO settings](https://betterstack.com/settings/sso/edit ";_blank") in Better Stack, enable the **Provisioning** toggle.
2.  Copy the **Bearer token**.
3.  In your Okta dashboard, open the Better Stack application and go to the **Provisioning** tab.
4.  For **Application username format**, select **Email**.
5.  Paste the **Bearer token** into the corresponding field.
6.  Click **Save**.
7.  While still on the **Provisioning** tab, click **Edit** next to **Provisioning to App**.
8.  Enable **Create Users**, **Update User Attributes**, **Deactivate Users**, and **Sync Password**.
9.  Click **Save**.

SCIM user provisioning is now active. When you assign users to the Better Stack application in Okta, they will sync automatically.

We also support pushing user groups from Okta. Each group will create a new team in Better Stack with the assigned users.

[warning]
Deprovisioning an Okta group from the Better Stack application will permanently delete the corresponding team and all its resources in Better Stack. Proceed with caution to avoid data loss.
[/warning]

## Troubleshooting

When you deactivate or remove a user from the SCIM integration in Okta, we automatically remove them from your Better Stack organization. If the user belongs to another organization, their account is not deleted completely—they are only detached from your organization and teams. Reconnecting the user via SCIM will re-add them.