# Okta SCIM User and Project/Role Management

Managing Statsig users through Okta SCIM provisions accounts automatically from your Okta directory. Assigning a user to the Statsig app in Okta creates their Statsig account, and removing the assignment deactivates it. You also push Okta groups to Statsig Project x Role Groups so role assignments stay in sync as your directory changes.

## Import existing Statsig users and groups

{% callout type="note" %}
You can't push users into groups unless you've assigned them to the integration.
{% /callout %}

* In Okta, go to the Statsig app's "Import" tab
* Click "Import Now" to fetch existing Statsig users and groups
* Process the imported users as needed

{% figure %}
![Okta Import tab listing Statsig users ready to be brought into Okta](https://docs.statsig.com/images/okta_scim_steps/step6-import-existing-users.png)
{% /figure %}

## Manage user assignments

* Use the "Assignments" tab in Okta to add or remove users from Statsig
* Adding a user assignment in Okta creates the user in Statsig. Removing the assignment deactivates their Statsig account.

{% figure %}
![Okta Assignments tab showing Statsig app user assignment controls](https://docs.statsig.com/images/okta_scim_steps/step7-manage-user-assignments.png)
{% /figure %}

## Push groups to Statsig

1. In Okta, go to the Statsig Integration's "Push Groups" tab
   {% figure %}
   ![Push Groups tab in Okta Statsig integration](https://docs.statsig.com/images/okta_scim_steps/step8-push-groups-1.png)
   {% /figure %}

2. Click the settings button and disable "Rename Groups"
   {% figure %}
   ![Push group settings dialog with Rename Groups toggle](https://docs.statsig.com/images/okta_scim_steps/step8-push-groups-2.png)
   {% /figure %}

3. Click "Push Groups" and select the method for finding groups in Okta.
   {% figure %}
   ![Okta modal prompting to find groups by name for push](https://docs.statsig.com/images/okta_scim_steps/step8-push-groups-3.png)
   {% /figure %}

4. Type in and select the Okta group to push to a Statsig Project x Role Group.

* Find groups under `Directory > Groups` in the Okta left nav. You see groups created from Okta and groups created by Statsig.
* The required groups are those you created in Okta. Filter by setting `Group source type` to `Okta groups`. If you have no Okta groups, create one and add members.
  {% figure %}
  ![Directory listing of Okta groups filtered to Okta source](https://docs.statsig.com/images/okta_scim_steps/step8-push-groups-4.png)
  {% /figure %}

5. Link the Okta group to the Statsig group with the role you want.

* Change `Match Result & Push Action` to `Link Group`
  {% figure %}
  ![Push group configuration selecting Link group action](https://docs.statsig.com/images/okta_scim_steps/step8-push-groups-5.png)
  {% /figure %}

6. Select the Statsig Project x Role Group that the Okta group pushes to.

* Statsig displays the Project x Role Group with the format `Statsig-<Project Name>-<Role Name>` on Okta.
* By default Okta only allows you to map 1 Okta Group to 1 Statsig Group.
  {% figure %}
  ![Statsig project role group dropdown showing Statsig-Project-Role format](https://docs.statsig.com/images/okta_scim_steps/step8-push-groups-6.png)
  {% /figure %}

7. Then link the Okta group to a Statsig Project x Role Group. On save, the group pushes to Statsig. All future group changes on Okta push to Statsig.
   {% figure %}
   ![Summary screen confirming Okta group linked to Statsig project role](https://docs.statsig.com/images/okta_scim_steps/step8-push-groups-7.png)
   {% /figure %}