---
title: Okta SCIM Org Roles
description: Map Okta groups to Statsig organization roles via SCIM provisioning so user permissions stay in sync between your identity provider and Statsig.
product: general
token_estimate: 891
---
# Okta SCIM Org Roles

> For AI agents: a documentation index is available at [/llms.txt](/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`.

## Update Okta user org role

For every user, Statsig surfaces a SCIM field named `statsigOrgRole`. Through this field, you can manage organization user roles. Okta can only push role updates to Statsig. Supported org roles are: `Member` `Admin` `Owner`

### Step 1. Create the custom attribute in Okta

Navigate to `Directory > Profile Editor` and select the User (default) Okta profile. This profile represents all Okta user attributes. Scroll down and press `Add Attribute` and fill out the new attribute to have the variable name `statsigOrgRole`.

![Okta profile editor showing custom statsigOrgRole attribute being added](https://docs.statsig.com/images/okta_scim_steps/org_steps/step1.png)

### Step 2. Create the custom attribute in the Statsig SCIM integration

Navigate to the `Statsig SCIM Integration's User Profile` in the `Profile Editor`. Add a new attribute that matches the following format:

- Variable name: `statsigOrgRole`
- External namespace: `urn:ietf:params:scim:schemas:core:2.0:User`
- Attribute type: either `Personal` or `Group`, depending if using groups for app assignment

![Statsig SCIM integration user profile with statsigOrgRole attribute definition](https://docs.statsig.com/images/okta_scim_steps/org_steps/step2.png)

### Step 3. Create a mapping from Statsig to Okta for the custom attribute

On the same Statsig SCIM profile editor, navigate to the `Mappings` button. Scroll down to the new attribute `statsigOrgRole` and map `user.statsigOrgRole` to the Okta attribute `statsigOrgRole`.

![Okta mapping editor linking statsigOrgRole between Statsig and Okta profiles](https://docs.statsig.com/images/okta_scim_steps/org_steps/step3.png)

### Step 4. Create a mapping from Okta to Statsig for the custom attribute

Now navigate to the Okta User to Statsig SCIM user mapping.

![Okta to Statsig user mapping screen for statsigOrgRole attribute](https://docs.statsig.com/images/okta_scim_steps/org_steps/step4_1.png)

Scroll down to the `statsigOrgRole` attribute and map `user.statsigOrgRole` to the Okta attribute `statsigOrgRole`.

![statsigOrgRole attribute mapping row pointing from user field to Okta attribute](https://docs.statsig.com/images/okta_scim_steps/org_steps/step4_2.png)

All users now sync with their organization role. You can also modify a user's role directly on the Statsig SCIM integration.

### Step 5. Modify integration mappings

Navigate to the Statsig SCIM integration provisioning section. Under the "To App" tab, scroll down to the `statsigOrgRole` attribute.

![Provisioning To App tab showing statsigOrgRole attribute settings](https://docs.statsig.com/images/okta_scim_steps/org_steps/step5_1.png)

Set the attribute value to `Map from Okta Profile` and `statsigOrgRole`. Set apply on `Create and update`.

![Set value dialog choosing Map from Okta Profile for statsigOrgRole](https://docs.statsig.com/images/okta_scim_steps/org_steps/step5_2.png)

Navigate to the "To Okta" tab and scroll down to the `statsigOrgRole` attribute.

![Provisioning To Okta tab listing statsigOrgRole attribute](https://docs.statsig.com/images/okta_scim_steps/org_steps/step5_3.png)

Set the attribute value to `Map from Statsig Profile` and `statsigOrgRole`. Set apply on `Create`.

![Set value dialog mapping statsigOrgRole from Statsig profile back to Okta](https://docs.statsig.com/images/okta_scim_steps/org_steps/step5_4.png)