> ## Documentation Index > Fetch the complete documentation index at: https://closedloop.sh/docs/llms.txt > Use this file to discover all available pages before exploring further. # Okta SCIM Provisioning > Configure Okta SCIM provisioning, Group Push, imports, and role entitlements for ClosedLoop AI. This guide shows Okta administrators how to configure SCIM 2.0 provisioning for ClosedLoop AI from the Okta Integration Network catalog. ## Prerequisites * An Okta admin account with permission to configure application provisioning. * A ClosedLoop AI workspace admin account. * Your ClosedLoop AI workspace ID. * Your ClosedLoop AI workspace region: US or EU. * The ClosedLoop AI Okta OIDC SSO setup should be configured before assigning users through SCIM. ## Supported Features | Feature | Support | | ------------------------------- | ------------------------------------------------ | | Create users | Supported | | Read users | Supported | | Update user attributes | Supported for the mapped attributes listed below | | Deactivate users | Supported | | PATCH users | Supported for `active` and `roles` | | Import new users | Supported | | Import profile updates | Supported for the mapped attributes listed below | | Create groups | Supported | | Read groups | Supported | | Update groups | Supported with PATCH | | Delete groups | Supported | | Group Push | Supported | | Role entitlements | Supported for Admin and Member | | Change password / sync password | Not supported | | Import User Schema | Not supported; use the mappings in this guide | ClosedLoop AI treats Okta as the source of truth for provisioned users, group membership, access status, and assigned role entitlements. ## Configure Okta 1. In Okta Admin, go to **Applications** > **Applications**. 2. Click **Browse App Catalog**. 3. Search for **ClosedLoop AI**. 4. Add the **ClosedLoop AI** integration. Enter the tenant settings for the ClosedLoop AI workspace you are connecting. | Label | Value | | ------------ | --------------------------------- | | Workspace ID | Your ClosedLoop AI workspace UUID | | Region | `us` or `eu` | Use `us` for `https://app.closedloop.sh`. Use `eu` for `https://eu.app.closedloop.sh`. 1. Open the generated ClosedLoop AI app instance in Okta. 2. Go to **Provisioning** > **Integration**. 3. Click **Configure API Integration**. 4. Select **Enable API integration**. 5. Click **Authenticate with ClosedLoop AI**. 6. Complete the authentication flow. 7. Click **Test API Credentials**. 8. Click **Save**. Okta uses OAuth 2.0 to obtain a scoped bearer token for SCIM calls. In **Provisioning** > **To App**, enable: | User operation | Setting | | ---------------------- | ------- | | Create Users | On | | Update User Attributes | On | | Deactivate Users | On | | Sync Password | Off | In **Provisioning** > **To Okta**, imports may remain enabled so Okta can import users and profile updates from ClosedLoop AI. On the **Sign On** tab, set **Application username format** to **Email**. ClosedLoop AI uses the SCIM `userName` value as the user's primary email address. Assign users or groups to the ClosedLoop AI app in Okta. Okta creates or links the user in ClosedLoop AI when the app is assigned. Deactivating the Okta user or unassigning the app removes the user's ClosedLoop AI workspace access and revokes active sessions. ## Okta OIN Values These are the SCIM values used by the ClosedLoop AI Okta catalog integration. | Okta field | Value | | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | Base URL | `'https://' + (app.region == 'eu' ? 'eu.api.closedloop.sh' : 'api.closedloop.sh') + '/api/scim/v2/' + app.team_id` | | Authorize endpoint | `'https://' + (app.region == 'eu' ? 'eu.api.closedloop.sh' : 'api.closedloop.sh') + '/api/okta/scim/oauth/authorize?team_id=' + app.team_id` | | Token endpoint | `'https://' + (app.region == 'eu' ? 'eu.api.closedloop.sh' : 'api.closedloop.sh') + '/api/okta/scim/oauth/token'` | | Scopes | `scim.read, scim.write, entitlements.read` | | Link to configuration guide | `https://closedloop.sh/docs/integrations/okta-scim-provisioning` | ## SCIM Attribute Mappings Keep these mappings in the Okta app profile. | Okta attribute | SCIM attribute | ClosedLoop AI usage | | -------------------- | ----------------- | ---------------------------- | | `user.email` | `userName` | Primary email address | | `user.firstName` | `name.givenName` | First name | | `user.lastName` | `name.familyName` | Last name | | `user.displayName` | `displayName` | Full name fallback | | App active state | `active` | Workspace access status | | Okta user ID | `externalId` | Stable Okta identifier | | Assigned entitlement | `roles` | ClosedLoop AI workspace role | ClosedLoop AI does not use these default Okta profile attributes. Remove the mappings and attributes if they appear in the app profile: | Unsupported attribute group | Attributes | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | | Name extras | `middleName`, `honorificPrefix`, `honorificSuffix`, `nickName` | | Contact details | `profileUrl`, `primaryPhone`, `primaryPhoneType`, `streetAddress`, `locality`, `region`, `postalCode`, `country`, `formatted` | | Locale and organization | `preferredLanguage`, `locale`, `timezone`, `userType`, `employeeNumber`, `costCenter`, `organization`, `division`, `department` | | Manager | `managerValue`, `managerDisplayName` | | Password | `password` | ## Group Push ClosedLoop AI supports Okta Group Push. 1. In Okta, open the ClosedLoop AI app instance. 2. Go to **Push Groups**. 3. Add the Okta group you want to push. 4. Confirm the group appears in ClosedLoop AI after Okta pushes it. Important behavior: * Users must be assigned to the ClosedLoop AI app and provisioned through SCIM before they can be added as members of a pushed group. * ClosedLoop AI stores the Okta group `displayName`, `externalId`, and members. * Group names should be unique within one ClosedLoop AI workspace. * Removing a user from a pushed group removes that group membership in ClosedLoop AI. It does not delete the user. ## Role Entitlements ClosedLoop AI exposes workspace roles as Okta entitlements. Resource type mapping: | Field | Value | | ------------- | ------------------------------- | | Resource Type | `Role` | | Endpoint | `/Roles` | | Properties | `id, displayName, description` | | Description | `ClosedLoop AI workspace roles` | Entitlement details: | Field | Value | | ---------------- | ------------------------ | | Display name | `Role` | | Variable name | `roles` | | Entitlement type | Single value entitlement | Entitlement values: | Display name | Value | | ------------ | -------- | | Admin | `admin` | | Member | `member` | ClosedLoop AI supports one workspace role entitlement per user. If no role entitlement is assigned, users are provisioned as Member by default. ## Verify Provisioning 1. Assign a test user to the ClosedLoop AI app in Okta. 2. Confirm Okta creates the user in ClosedLoop AI. 3. Update the test user's first name or last name in Okta and run provisioning. 4. Confirm the profile update appears in ClosedLoop AI. 5. Push a test group that contains the provisioned user. 6. Confirm the group and membership appear in ClosedLoop AI. 7. Assign the Admin role entitlement to the test user. 8. Confirm the user becomes an admin in ClosedLoop AI. 9. Unassign or deactivate the test user in Okta. 10. Confirm the user's ClosedLoop AI workspace access is removed. ## Troubleshooting | Symptom | Fix | | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | Okta reports an invalid SCIM base URL | Confirm the Base URL uses Okta Expression Language string concatenation and that the tenant setting names are `region` and `team_id`. | | API credential validation fails | Confirm the Workspace ID belongs to the selected region and retry **Authenticate with ClosedLoop AI**. | | Users are created with the wrong username | Set **Application username format** to **Email** on the Sign On tab. | | Profile updates do not sync | Confirm unsupported attributes were removed and the supported attributes remain mapped. | | Group Push fails for members | Confirm every group member is assigned to the ClosedLoop AI app and provisioned before the group is pushed. | | Role entitlements do not appear | Confirm the SCIM OAuth scopes include `entitlements.read`, then refresh the Governance tab. | | Change password fails | Leave password synchronization disabled. ClosedLoop AI does not accept SCIM password updates. | ## Support For help configuring Okta SCIM provisioning with ClosedLoop AI, contact `support@closedloop.sh`.