SCIM User Provisioning

How SCIM works

SCIM (System for Cross-domain Identity Management) is a standardized protocol that automates user provisioning and management across multiple platforms. By integrating SCIM with your preferred Identity Provider (IdP), such as Okta, you can manage user creation, updates, and de-provisioning within Statsig. Statsig offers an Okta SCIM integration.

How to obtain SCIM auth key

1. Navigate to Organization Access Management: Go to Settings > Organization > Organization Info > Access Management.
2. Generate a Key: If you haven't enabled SCIM yet, generate a new authentication key.
3. Deactivate the Key: To disable the key, select Deactivate.
4. Regenerate the Key: If you suspect the key has been compromised, you can regenerate a new one to replace it.

Current SCIM offering

Okta

• Push Users: Assigning users to the Statsig application in Okta automatically adds them as members of your organization in Statsig. Unassigning users deactivates them and wipes all roles/permissions.
• Import Users: Statsig can import users into Okta and either match them to existing Okta users, or create them as new Okta users.
• Import Groups: Import project/team roles as groups in Okta. You can't modify imported groups in Okta.
• Push Groups: Push groups to Statsig to update user project/team roles.

Okta Setup Guide

Manage SCIM group aliases

SCIM group aliases map an IdP group name that you can't change onto a Statsig project and role, so provisioning matches even when the group name doesn't follow the Statsig-<Project>-<Role> convention. For what aliases do and when to use them, go to SCIM Concepts.

Manage aliases from the same Access Management panel where you generate the SCIM key. The SCIM Group Aliases block appears below the SCIM key row when SCIM is enabled and you're an Organization Admin.

View existing aliases

The alias table lists each alias name, its resolved target project, and its target role. A Stale badge marks any alias whose target no longer resolves, for example after you delete the target project. Delete or repoint stale aliases so provisioning stays predictable.

Add an alias

1. Go to Settings > Organization > Organization Info > Access Management.
2. In the SCIM Group Aliases block, click Add alias.
3. Enter the external group name from your IdP, such as PP_SSO_STATSIG_OSLO_ADMIN. Statsig rejects names that start with the reserved Statsig- prefix.
4. Select the target project.
5. Select the target role. The picker includes custom roles.
6. Click Save.

Repoint or delete an alias

To change an alias target, delete the alias and add it again with the new project or role. To remove an alias, click Delete and confirm. Statsig writes an audit-log entry for every alias you add or delete.