# Okta SCIM Setup

SCIM (System for Cross-domain Identity Management) connects Statsig and Okta to automate user provisioning and management. After you set it up, Okta creates, updates, and deactivates Statsig users automatically as your directory changes.

To set up SCIM, you need an Okta account with admin access and a [SCIM Key](https://docs.statsig.com/access-management/scim/overview#how-to-obtain-scim-auth-key) from the Statsig Console, which requires Statsig Org Admin rights.

{% callout type="note" %}
### Integration notes

* SCIM doesn't support user email management yet.
* When you remove a user from Statsig, Okta automatically unassigns them. If you unassign or deactivate a user in Okta, Statsig removes them from the organization.
* SCIM doesn't support creating Statsig Projects and Roles.
{% /callout %}

## Step 1: Create a new app integration in Okta

* Log in to your Okta admin console
* Navigate to Applications > Applications > Create App Integration
* Select "SWA - Secure Web Authentication"

{% figure %}
![Okta Create App Integration dialog selecting Secure Web Authentication](https://docs.statsig.com/images/okta_scim_steps/step1-create-new-custom-integration.png)
{% /figure %}

## Step 2: Configure app settings

* Set the App name to "Statsig SCIM"
* Enter a placeholder URL for the App Login Page (required field, not used for SCIM). Example: `https://console.statsig.com/`

{% figure %}
![Okta app settings form with Statsig SCIM name and placeholder login URL](https://docs.statsig.com/images/okta_scim_steps/step2-configure-app-settings.png)
{% /figure %}

## Step 3: Enable SCIM provisioning

* After creating the integration, go to the "General" tab
* Click on "Edit" in the "Provisioning" section
* Enable "SCIM Provisioning"

{% figure %}
![Okta application general tab highlighting provisioning section and SCIM toggle](https://docs.statsig.com/images/okta_scim_steps/step3-enable-scim.png)
{% /figure %}

## Step 4: Configure SCIM settings

:::info

`Import Groups` requires an Okta flag `SELECTIVE_APP_IMPORT_PLATFORM`. If your organization has this flag enabled, select this option. If it doesn't, leave it unchecked.

:::

* Navigate to the `Provisioning` tab
* Set the SCIM connector base URL to: [https://statsigapi.net/scim](https://statsigapi.net/scim)
* Set "Unique identifier field for users" to `userName`
* Enable
  * `Import New Users and Profile Update`
  * `Push New Users`
  * `Push Profile Updates`
  * `Push Groups`
  * `Import Groups` (Only if your organization has the `SELECTIVE_APP_IMPORT_PLATFORM` flag enabled; refer to note above)
* Set the authentication mode to "HTTP Header"
* For the authorization header, use the SCIM Bearer token your Org Admin generated in Statsig. Go to [How to Obtain SCIM Auth Key](https://docs.statsig.com/access-management/scim/overview#how-to-obtain-scim-auth-key) for details.

{% figure %}
![Okta provisioning tab showing SCIM base URL and push settings](https://docs.statsig.com/images/okta_scim_steps/step4.png)
{% /figure %}

## Step 5: Configure Okta to Statsig settings

* Enable "Create Users"
* Enable "Update User Attributes"
* Enable "Deactivate Users"

{% figure %}
![Provisioning To App settings enabling create, update, and deactivate actions](https://docs.statsig.com/images/okta_scim_steps/step5-configure-okta-to-statsig-settings.png)
{% /figure %}

## Step 6: Import existing Statsig users and groups

* In Okta, go to the Statsig app's "Import" tab
* Click "Import Now" to fetch existing Statsig users and groups
* Process the imported users as needed

{% figure %}
![Okta Import tab with Import Now button for Statsig users and groups](https://docs.statsig.com/images/okta_scim_steps/step6-import-existing-users.png)
{% /figure %}