# Okta SCIM Setup (OIN SUBMISSION)

## ⚠️⚠️ This is required documentation for the official Okta integration submission. For now, refer to the existing guide at [Setup](https://docs.statsig.com/access-management/scim/okta_scim_setup)

This guide describes how to set up SCIM (System for Cross-domain Identity Management) integration between Statsig and Okta for automated user provisioning and management.

To set up SCIM, you need an Okta account with admin access and a [SCIM Key](https://docs.statsig.com/access-management/scim/overview#how-to-obtain-scim-auth-key) from the Statsig Console, which requires Statsig Org Admin rights.

{% callout type="note" %}
### Integration notes

* SCIM doesn't support user email management yet.
* When you remove a user from Statsig, Okta automatically unassigns them. If you unassign or deactivate a user in Okta, Statsig removes them from the organization.
* SCIM doesn't support creating Statsig Projects and Roles.
{% /callout %}

## Step 1: Add the Statsig app from the Okta app catalog

* Log in to your Okta admin console

* Navigate to Applications > Applications > Browse App Catalog

  ![image](https://docs.statsig.com/images/access-management/scim/okta-scim/scim_step_1.1.png)

* Search for and select "Statsig"

  ![image](https://docs.statsig.com/images/access-management/scim/okta-scim/scim_step_1.2.png)

* Select "Add Integration"

  ![image](https://docs.statsig.com/images/access-management/scim/okta-scim/scim_step_1.3.png)

* Set your application label, then select "Done"
  ![image](https://docs.statsig.com/images/access-management/scim/okta-scim/scim_step_1.4.png)

## Step 2: Enable API integration

* Navigate to the "Provisioning" tab of the generated app -> Select "Enable API Integration"
* For the API Token, use the SCIM Bearer token your Org Admin generated in Statsig. Go to [How to Obtain SCIM Auth Key](https://docs.statsig.com/access-management/scim/overview#how-to-obtain-scim-auth-key) for details.
* **⚠️Important⚠️** Prepend "Bearer " to the token obtained from Statsig, e.g. "Bearer scim-G22A\*\*\*"
  ![image](https://docs.statsig.com/images/access-management/scim/okta-scim/scim_step_2.1.png)

## Step 3: Configure Okta to Statsig settings

* Enable "Create Users"
* Enable "Update User Attributes"
* Enable "Deactivate Users"

{% figure %}
![Provisioning To App settings enabling create, update, and deactivate
actions](https://docs.statsig.com/images/okta_scim_steps/step5-configure-okta-to-statsig-settings.png)
{% /figure %}

## Step 4: Import existing Statsig users and groups

* In Okta, go to the Statsig app's "Import" tab
* Click "Import Now" to fetch existing Statsig users and groups
* Process the imported users as needed

{% figure %}
![Okta Import tab with Import Now button for Statsig users and
groups](https://docs.statsig.com/images/okta_scim_steps/step6-import-existing-users.png)
{% /figure %}