Okta SCIM Provisioning

This guide shows Okta administrators how to configure SCIM 2.0 provisioning for ClosedLoop AI from the Okta Integration Network catalog.

Prerequisites

An Okta admin account with permission to configure application provisioning.
A ClosedLoop AI workspace admin account.
Your ClosedLoop AI workspace ID.
Your ClosedLoop AI workspace region: US or EU.
The ClosedLoop AI Okta OIDC SSO setup should be configured before assigning users through SCIM.
An Okta Identity Governance subscription if you want to manage role entitlements.

Supported Features

Feature	Support
Create users	Supported
Read users	Supported
Update user attributes	Supported for the mapped attributes listed below
Deactivate users	Supported
PATCH users	Supported for `active` and `roles`
Import new users	Supported
Import profile updates	Supported for the mapped attributes listed below
Create groups	Supported
Read groups	Supported
Update groups	Supported with PATCH
Delete groups	Supported
Group Push	Supported
Role entitlements	Supported for Admin and Member
Change password / sync password	Not supported
Import User Schema	Not supported; use the mappings in this guide

ClosedLoop AI treats Okta as the source of truth for provisioned users, group membership, access status, and assigned role entitlements.

Configure Okta

Step 1: Add ClosedLoop AI from the Okta catalog

In Okta Admin, go to Applications > Applications.
Click Browse App Catalog.
Search for ClosedLoop AI.
Add the ClosedLoop AI integration.

Step 2: Enter tenant settings

Enter the tenant settings for the ClosedLoop AI workspace you are connecting.

Label	Value
Workspace ID	Your ClosedLoop AI workspace UUID
Region	`us` or `eu`

Use us for https://app.closedloop.sh. Use eu for https://eu.app.closedloop.sh.

Step 3 (optional): Enable Entitlement Management

Complete this step only if your organization uses Okta Identity Governance to manage ClosedLoop AI workspace roles.

Open the generated ClosedLoop AI app instance in Okta.
Go to the General tab.
In the Entitlement Management or Identity Governance section, click Edit.
Set Entitlement Management or Governance Engine to Enabled.
Click Save, then refresh the page until the Governance tab appears.

Enable Entitlement Management on a new app instance before configuring SCIM provisioning. If Okta prevents this change because provisioning is already enabled, create a new ClosedLoop AI app instance instead of disabling provisioning on the active instance.See Enable Entitlement Management in the Okta documentation.

Step 4: Enable API integration

Open the generated ClosedLoop AI app instance in Okta.
Go to Provisioning > Integration.
Click Configure API Integration.
Select Enable API integration.
Click Authenticate with ClosedLoop AI.
Complete the authentication flow.
Click Test API Credentials.
Click Save.

Okta uses OAuth 2.0 to obtain a scoped bearer token for SCIM calls.

Step 5: Enable provisioning operations

In Provisioning > To App, enable:

User operation	Setting
Create Users	On
Update User Attributes	On
Deactivate Users	On
Sync Password	Off

In Provisioning > To Okta, imports may remain enabled so Okta can import users and profile updates from ClosedLoop AI.

Step 6: Configure username format

On the Sign On tab, set Application username format to Email.ClosedLoop AI uses the SCIM userName value as the user’s primary email address.

Step 7: Assign users and groups

Assign users or groups to the ClosedLoop AI app in Okta.Okta creates or links the user in ClosedLoop AI when the app is assigned. Deactivating the Okta user or unassigning the app removes the user’s ClosedLoop AI workspace access and revokes active sessions.

Okta OIN Values

These are the SCIM values used by the ClosedLoop AI Okta catalog integration.

Okta field	Value
Base URL	`'https://' + (app.region == 'eu' ? 'eu.api.closedloop.sh' : 'api.closedloop.sh') + '/api/scim/v2/' + app.team_id`
Authorize endpoint	`'https://' + (app.region == 'eu' ? 'eu.api.closedloop.sh' : 'api.closedloop.sh') + '/api/okta/scim/oauth/authorize?team_id=' + app.team_id`
Token endpoint	`'https://' + (app.region == 'eu' ? 'eu.api.closedloop.sh' : 'api.closedloop.sh') + '/api/okta/scim/oauth/token?team_id=' + app.team_id`
Scopes	`scim.read, scim.write, entitlements.read`
Link to configuration guide	`https://closedloop.sh/docs/integrations/okta-scim-provisioning`

SCIM Attribute Mappings

Keep these mappings in the Okta app profile.

Okta attribute	SCIM attribute	ClosedLoop AI usage
`user.email`	`userName`	Primary email address
`user.firstName`	`name.givenName`	First name
`user.lastName`	`name.familyName`	Last name
`user.displayName`	`displayName`	Full name fallback
App active state	`active`	Workspace access status
Okta user ID	`externalId`	Stable Okta identifier
Assigned entitlement	`roles`	ClosedLoop AI workspace role

ClosedLoop AI does not use these default Okta profile attributes. Remove the mappings and attributes if they appear in the app profile:

Unsupported attribute group	Attributes
Name extras	`middleName`, `honorificPrefix`, `honorificSuffix`, `nickName`
Contact details	`profileUrl`, `primaryPhone`, `primaryPhoneType`, `streetAddress`, `locality`, `region`, `postalCode`, `country`, `formatted`
Locale and organization	`preferredLanguage`, `locale`, `timezone`, `userType`, `employeeNumber`, `costCenter`, `organization`, `division`, `department`
Manager	`managerValue`, `managerDisplayName`
Password	`password`

Group Push

ClosedLoop AI supports Okta Group Push.

In Okta, open the ClosedLoop AI app instance.
Go to Push Groups.
Add the Okta group you want to push.
Confirm the group appears in ClosedLoop AI after Okta pushes it.

Important behavior:

Users must be assigned to the ClosedLoop AI app and provisioned through SCIM before they can be added as members of a pushed group.
ClosedLoop AI stores the Okta group displayName, externalId, and members.
Group names should be unique within one ClosedLoop AI workspace.
Removing a user from a pushed group removes that group membership in ClosedLoop AI. It does not delete the user.

Role Entitlements

ClosedLoop AI exposes workspace roles as Okta entitlements. Role entitlements require Okta Identity Governance and the Entitlement Management setup described in Step 3. Resource type mapping:

Field	Value
Resource Type	`Role`
Endpoint	`/Roles`
Properties	`id, displayName, description`
Description	`ClosedLoop AI workspace roles`

Entitlement details:

Field	Value
Display name	`Role`
Variable name	`roles`
Entitlement type	Single value entitlement

Entitlement values:

Display name	Value
Admin	`admin`
Member	`member`

ClosedLoop AI supports one workspace role entitlement per user. If no role entitlement is assigned, users are provisioned as Member by default.

Verify Provisioning

Assign a test user to the ClosedLoop AI app in Okta.
Confirm Okta creates the user in ClosedLoop AI.
Update the test user’s first name or last name in Okta and run provisioning.
Confirm the profile update appears in ClosedLoop AI.
Push a test group that contains the provisioned user.
Confirm the group and membership appear in ClosedLoop AI.
Assign the Admin role entitlement to the test user.
Confirm the user becomes an admin in ClosedLoop AI.
Unassign or deactivate the test user in Okta.
Confirm the user’s ClosedLoop AI workspace access is removed.

Troubleshooting

Symptom	Fix
Okta reports an invalid SCIM base URL	Confirm the Base URL uses Okta Expression Language string concatenation and that the tenant setting names are `region` and `team_id`.
API credential validation fails	Confirm the Workspace ID belongs to the selected region and retry Authenticate with ClosedLoop AI.
Users are created with the wrong username	Set Application username format to Email on the Sign On tab.
Profile updates do not sync	Confirm unsupported attributes were removed and the supported attributes remain mapped.
Group Push fails for members	Confirm every group member is assigned to the ClosedLoop AI app and provisioned before the group is pushed.
Role entitlements do not appear	Confirm the SCIM OAuth scopes include `entitlements.read`, then refresh the Governance tab.
Change password fails	Leave password synchronization disabled. ClosedLoop AI does not accept SCIM password updates.

Support

For help configuring Okta SCIM provisioning with ClosedLoop AI, contact support@closedloop.sh.

Workspace

SSO & provisioning

Security & procurement

Prerequisites

Supported Features

Configure Okta

Okta OIN Values

SCIM Attribute Mappings

Group Push

Role Entitlements

Verify Provisioning

Troubleshooting

Support

​Prerequisites

​Supported Features

​Configure Okta

​Okta OIN Values

​SCIM Attribute Mappings

​Group Push

​Role Entitlements

​Verify Provisioning

​Troubleshooting

​Support

Prerequisites

Supported Features

Configure Okta

Okta OIN Values

SCIM Attribute Mappings

Group Push

Role Entitlements

Verify Provisioning

Troubleshooting

Support