Skip to main content

Set Up SCIM with Okta

SCIM automated user provisioning and deprovisioning with Okta

This guide walks you through configuring SCIM 2.0 provisioning between Okta and BetaTesting. SCIM enables automatic user creation, updates, deactivation, and group synchronization from Okta to BetaTesting.

Prerequisites

Before setting up SCIM, you must have:

  • A SAML-based SSO connection already configured between Okta and BetaTesting (see Set Up SSO with Okta)

  • Administrator access to your Okta admin console

  • The following values from your BetaTesting account manager:

Important: SCIM provisioning in Okta requires a SAML app integration (not OIDC). If you originally set up an OIDC-based integration, contact your BetaTesting account manager to migrate to a SAML-based connection.

Step 1: Enable SCIM Provisioning on Your Okta App

  1. Go to your BetaTesting SAML app in the Okta admin console

  2. Go to the General tab > App Settings > Edit

  3. Under Provisioning, select SCIM

  4. Click Save

A new Provisioning tab will appear on your app.

Step 2: Configure the SCIM Connection

  1. Go to the Provisioning tab

  2. Click Edit under SCIM Connection

  3. Configure the following:

Setting

Value

SCIM connector base URL

The SCIM base URL provided by BetaTesting (e.g., https://betatesting.com/api/scim/v2)

Unique identifier field for users

userName

Supported provisioning actions

Check all that apply: Push New Users, Push Profile Updates, Push Groups

Authentication Mode

HTTP Header

Authorization

Paste the Bearer token provided by BetaTesting

  1. Click Test Connector Configuration to verify the connection

    • Okta will call BetaTesting's /ServiceProviderConfig endpoint

    • If the test succeeds, you'll see a success message

  2. Click Save

Step 3: Enable Provisioning Actions

  1. Under Provisioning > To App, click Edit

  2. Enable the following:

    • Create Users - Automatically create BetaTesting accounts when users are assigned in Okta

    • Update User Attributes - Sync profile changes from Okta to BetaTesting

    • Deactivate Users - Deactivate BetaTesting accounts when users are unassigned in Okta

  3. Click Save

Step 4: Push Groups

Groups pushed from Okta to BetaTesting are used for automatic role assignment. See SSO Role Mapping & Permissions for details on how groups map to roles.

  1. In your BetaTesting app, go to the Push Groups tab

  2. Click Push Groups > Find groups by name

  3. Search for and select the groups you want to push to BetaTesting (e.g., "Admins", "Support", "Testers")

  4. For each group, verify that Push group memberships immediately is checked

  5. Click Save

Okta will now:

  • Create each selected group in BetaTesting via the SCIM Groups endpoint

  • Sync group memberships as users are added or removed

Tell your BetaTesting account manager which groups you're pushing and what BetaTesting role each group should map to. They will configure role mappings on the BetaTesting side.

Step 5: Map the pushed groups to BetaTesting roles

You do this part yourself in BetaTesting, and it is worth doing before your first users sign in. Anyone who does not match a mapping gets the connection's default role.

  1. In BetaTesting, open Integrations from your company menu and go to the Single Sign-On tab.

  2. Open your connection and find the Map IdP claims to BetaTesting roles section.

  3. Click Add mapping.

  4. In the claim value field, type the pushed group's name exactly as it appears in Okta.

  5. Choose the role it should grant: Full admin, Support only, Read only, or Tester.

  6. Click Add. Repeat for each group you pushed.

If someone belongs to more than one mapped group, the mapping nearest the top of the list wins. Drag rows to change that order. The top row is labelled Highest priority.

Step 6: Assign users

  1. In your BetaTesting app in Okta, go to the Assignments tab.

  2. Click Assign, then Assign to People or Assign to Groups.

  3. Select the users or groups who should have BetaTesting access.

  4. Click Assign.

For each assigned person, Okta calls the BetaTesting SCIM API to create the account and adds them to any pushed groups they belong to. BetaTesting then assigns the role from your mappings.

Step 7: Test provisioning and sign-in

  1. Check that assigned users now have BetaTesting accounts. The connection page shows how many members have signed in through SSO and when the last sign-in happened.

  2. Open your company sign-in page at your subdomain, for example acme.betatesting.com/login, in a private browser window.

  3. Sign in as a user who was provisioned through SCIM.

  4. Confirm they can sign in, and that their role matches the group mapping you configured.

Step 8: Test deprovisioning

  1. In Okta, unassign a test user from the BetaTesting app.

  2. Wait for Okta to send the deactivation request, which happens automatically.

  3. Try to sign in as that user.

  4. They should see an error and be unable to reach BetaTesting.

Things to know

  • Once SCIM is switched on for a connection, only people Okta has provisioned can sign in. Anyone else sees a message saying their account has not been provisioned.

  • With SCIM in play, roles come from the groups Okta pushes rather than from claims in the SAML assertion. The claim value in each mapping has to be the pushed group's name.

  • Group name matching is exact and case sensitive.

  • Role mappings, allowed email domains, the default role, and the enable toggle are all yours to change on the connection page, at any time.

  • The SCIM base URL and bearer token are the exception. Ask your account manager if you need to rotate the token.

  • SCIM changes are applied as they arrive, not on a schedule.

Next steps

Related Articles
Did this answer your question?