> ## Documentation Index
> Fetch the complete documentation index at: https://statsig-4b2ff144-kill-dead-node-pages.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta SCIM Setup

This guide outlines the process for setting up SCIM (System for Cross-domain Identity
Management) integration between Statsig and Okta. This integration allows for automated
user provisioning and management.

## Prerequisites

* An Okta account with admin access
* A SCIM Key from the [Statsig Console](/access-management/scim/overview#how-to-obtain-scim-auth-key) (requires Statsig Org Admin rights)

<Note>
  ### Integration Notes

  * User email management is not enabled on SCIM yet.
  * When a user is removed from Statsig, they will be automatically unassigned in Okta. Conversely, if a user is unassigned or deactivated in Okta, they will be removed from the Statsig Organization.
  * Creation of Statsig Projects and Roles is not supported via SCIM.
</Note>

## Step 1: Create a New App Integration in Okta

* Log in to your Okta admin console
* Navigate to Applications > Applications > Create App Integration
* Select "SWA - Secure Web Authentication"

<Frame>
  <img src="https://mintcdn.com/statsig-4b2ff144-kill-dead-node-pages/Vb2HaaR2D_Fcseq_/images/okta_scim_steps/step1-create-new-custom-integration.png?fit=max&auto=format&n=Vb2HaaR2D_Fcseq_&q=85&s=e142a8cbcc900d3bef17d3cc2da1dd05" alt="img" width="2078" height="1378" data-path="images/okta_scim_steps/step1-create-new-custom-integration.png" />
</Frame>

## Step 2: Configure App Settings

* Set the App name to "Statsig SCIM"
* Enter a placeholder URL for the App Login Page (this is a required field but not used for SCIM). Ex: `https://console.statsig.com/`

<Frame>
  <img src="https://mintcdn.com/statsig-4b2ff144-kill-dead-node-pages/Vb2HaaR2D_Fcseq_/images/okta_scim_steps/step2-configure-app-settings.png?fit=max&auto=format&n=Vb2HaaR2D_Fcseq_&q=85&s=e916fdb76532320233b1765b7f98d8ad" alt="img" width="1514" height="1308" data-path="images/okta_scim_steps/step2-configure-app-settings.png" />
</Frame>

## Step 3: Enable SCIM Provisioning

* After creating the integration, go to the "General" tab
* Click on "Edit" in the "Provisioning" section
* Enable "SCIM Provisioning"

<Frame>
  <img src="https://mintcdn.com/statsig-4b2ff144-kill-dead-node-pages/Vb2HaaR2D_Fcseq_/images/okta_scim_steps/step3-enable-scim.png?fit=max&auto=format&n=Vb2HaaR2D_Fcseq_&q=85&s=f5838edb51aad23ab0bae3295561804c" alt="img" width="1538" height="1326" data-path="images/okta_scim_steps/step3-enable-scim.png" />
</Frame>

## Step 4: Configure SCIM Settings

:::info

`Import Groups` requires an Okta flag `SELECTIVE_APP_IMPORT_PLATFORM`. If this flag is enabled for your organization, please select this option. If it is not, leave it unchecked.

:::

* Navigate to the `Provisioning` tab
* Set the SCIM connector base URL to: [https://statsigapi.net/scim](https://statsigapi.net/scim)
* Set "Unique identifier field for users" to `userName`
* Enable
  * `Import New Users and Profile Update`
  * `Push New Users`
  * `Push Profile Updates`
  * `Push Groups`
  * `Import Groups` (Only if your organization has the `SELECTIVE_APP_IMPORT_PLATFORM` flag enabled, see note above)
* Set the authentication mode to "HTTP Header"
* For the authorization header, use the SCIM Bearer token generated in Statsig by your Org Admin. See [How to Obtain SCIM Auth Key](/access-management/scim/overview#how-to-obtain-scim-auth-key) for more details.

<Frame>
  <img src="https://mintcdn.com/statsig-4b2ff144-kill-dead-node-pages/Vb2HaaR2D_Fcseq_/images/okta_scim_steps/step4.png?fit=max&auto=format&n=Vb2HaaR2D_Fcseq_&q=85&s=99cb483f22719c163e452e227a6e888e" alt="img" width="2038" height="1836" data-path="images/okta_scim_steps/step4.png" />
</Frame>

## Step 5: Configure Okta to Statsig Settings

* Enable "Create Users"
* Enable "Update User Attributes"
* Enable "Deactivate Users"

<Frame>
  <img src="https://mintcdn.com/statsig-4b2ff144-kill-dead-node-pages/Vb2HaaR2D_Fcseq_/images/okta_scim_steps/step5-configure-okta-to-statsig-settings.png?fit=max&auto=format&n=Vb2HaaR2D_Fcseq_&q=85&s=daa5a292f7602ef6fb420e4e9d5ad14a" alt="img" width="2038" height="1766" data-path="images/okta_scim_steps/step5-configure-okta-to-statsig-settings.png" />
</Frame>

## Step 6: Import Existing Statsig Users and Groups

* In Okta, go to the Statsig app's "Import" tab
* Click "Import Now" to fetch existing Statsig users and groups
* Process the imported users as needed

<Frame>
  <img src="https://mintcdn.com/statsig-4b2ff144-kill-dead-node-pages/Vb2HaaR2D_Fcseq_/images/okta_scim_steps/step6-import-existing-users.png?fit=max&auto=format&n=Vb2HaaR2D_Fcseq_&q=85&s=4d022873459d314cecaf4f32824a0dfb" alt="img" width="2040" height="1440" data-path="images/okta_scim_steps/step6-import-existing-users.png" />
</Frame>