Setting up End Users SCIM - Okta

Integrating Okta via SCIM into Addigy enables you to automatically sync your Okta user directory into Addigy, assign device management to users based on Identity attributes, and maintain synchronized user and group memberships across both platforms.

This integration provides:

• Centralized User Management – Sync your Okta directory users automatically into Addigy
• Device Assignment – Assign devices to users making it simple to identify device inventories
• Single Source of Truth – Keep user data synchronized inside of Addigy with real time events
• Scalability – Automate provisioning as your organization grows

How Okta SCIM Provisioning Works

1. Create a custom SCIM application in Okta
2. Configure SCIM settings and enter Addigy credentials
3. Test the connector to verify connectivity
4. Assign Okta users and groups to the SCIM app
5. Optionally push Okta groups to Addigy for device targeting
6. Okta syncs users/groups to Addigy on a regular cadence
7. Verify users and groups appear in Addigy

Before You Begin

• Okta Access: Okta admin account with permission to create applications and manage groups
• Addigy Access: Addigy admin account with SCIM support enabled
• Addigy SCIM Credentials: Have your SCIM Base URL and Bearer Token ready (see Generate Addigy SCIM Credentials below)
• Okta Groups: Decide which Okta groups should be assigned to the SCIM app and which should be pushed to Addigy

Step 1: Generate Your SCIM URL and Token from Addigy

Purpose: Create the SCIM endpoint and authentication credentials needed for Okta to communicate with Addigy.

Instructions:

1. Log in to Addigy as an administrator
2. Navigate to End Users page on the left hand navigation
3. On the End User Page select Setup End User Management
4. You will be presented with:
   1. SCIM URL (e.g., https://***.addigy.com/scim/v2)
   2. Bearer Token (a long alphanumeric string)
5. Copy both values and store them securely – you'll need these for Okta configuration
6. Click I've copied URL and Token
7. ⚠️ Security Note: Treat the Bearer Token like a password. Do not share it publicly or commit it to version control. If compromised, regenerate immediately from the same settings page.

Step 2: Create a SCIM App Integration in Okta

Purpose: Set up a new custom application in Okta to serve as the SCIM provider.

Create the Application

1. Log into your Okta tenant.
2. In the left-hand navigation, go to Applications → Applications.
3. Click Create App Integration.
4. Select SAML 2.0 as the application type and click Next.
5. In General Settings, give the app a meaningful name (e.g., "Addigy SCIM Provisioning") and check the box within the App visibility section.
6. Click Next.

Configure SAML Settings (Placeholder)

7. In SAML Settings, enter a dummy URL in both the Single sign-on URL and Audience URI (SP Entity ID) fields.
   • Example: https://addigy.example.com/sso (this does not need to be valid)
   • Why: These fields are required to proceed, but we won't use them for SCIM provisioning
8. Click Next.
9. In the Help Okta Support understand how you configured this application section, select the checkbox for This is an internal app that we have created.
10. Click Finish. You will be taken to the application overview page.

Step 3: Configure SCIM Settings in Okta

Purpose: Enable SCIM provisioning and enter Addigy's SCIM credentials.

Enable SCIM Provisioning

1. In the Addigy SCIM app, navigate to the General tab.
2. In the Settings section, click Edit.
3. In the Provisioning dropdown, select SCIM.
4. Do not modify any other settings.
5. Click Save.

Configure SCIM Integration Details

6. Navigate to the Provisioning tab.
7. In the Integration section, click Edit.
8. Configure the following fields:

9. Click Test Connector Configuration to verify the connection.
10. Review the Detected Features list. Confirm that only the following items display a checkmark (✓):
    • ✓ Create Users
    • ✓ Update User Attributes
    • ✓ Push Groups
11. If other features are checked, they will be ignored during provisioning.
12. Click Save.

Configure Provisioning to App (Addigy)

12. While still on the Provisioning tab, go to the To App section and click Edit.
13. In the Provisioning to App section, enable the following:
    • ✓ Create Users
    • ✓ Update User Attributes
    • ✓ Deactivate Users
14. Click Save.

Configure Attribute Mappings (Optional)

15. (Optional) In the Attribute Mappings section, review and edit the user attributes Okta will send to Addigy.
    • Addigy will only store and use the attributes specified in your SCIM configuration
    • Common attributes: email, displayName, firstName, lastName, department, mobilePhone
    • Customize mappings based on your Addigy attribute requirements
16. Click Save once complete.

Step 4: Assign Users to Addigy via Okta Groups

Purpose: Specify which Okta users should be provisioned to Addigy.

Create an Okta Group for Addigy Users

The recommended approach is to create a dedicated Okta group (e.g., addigy_users) that contains all users to be provisioned to Addigy.

1. In a new browser tab, navigate to Directory → Groups.
2. Click Add Group.
3. Give the group a meaningful name (e.g., addigy_users) and click Save.
4. Search for the group you just created and open it.
5. Click Add Members and select the users you want to provision to Addigy.
   • You can add individual users or select multiple users at once
6. Click Save.

Assign the Group to the SCIM App

7. Navigate back to the browser tab where the Addigy SCIM app is open.
8. Go to the Assignments tab.
9. Click Assign → Assign to Groups.
10. Search for the group you created (e.g., addigy_users) and click to select it.
11. Click Assign → Save and Go Back.
12. Confirm that the group now appears in the Assignments tab's Groups section.
    • If the group does not display immediately, refresh the browser tab.

All users in this group will now be provisioned to Addigy. They will appear in the Addigy Users module within 5–10 minutes.

Step 5: (Optional) Push Okta Groups to Addigy

Purpose: Sync Okta groups to Addigy so you can use them for device assignment and targeting in Addigy policies.
 

Important Considerations

Group Assignment Best Practice:

• Groups used in the Assignments tab (to assign users to the SCIM app) cannot be used in the Push Groups tab
• Okta recommends creating separate groups for assignment vs. pushing
• If the same group is added to both places, the assignment will take precedence and the group may not push

Recommended Setup:

• Create one "assignment" group (e.g., addigy_users) and add it to the Assignments tab
• Use your existing Okta groups (e.g., developers, sales, marketing) in the Push Groups tab
• Ensure members of pushed groups are also members of the assignment group
  
   

Push Groups to Addigy

1. In the Addigy SCIM app, navigate to the Push Groups tab.
2. Click Push Groups → Find groups by name.
   • (Alternatively, you can use Find groups by rule if you prefer rule-based selection)
3. Search for and select an Okta group you want to push to Addigy (e.g., developers).
4. Ensure Create Group is selected as the action.
5. Click Save & Add Another.
6. Repeat steps 3–5 for each additional group you want to push to Addigy.
7. Click Save.

Important: For the user-group association to work, the members of the pushed groups must also be members of the assignment group (e.g., addigy_users). Users must be synced to Addigy before they can be associated with pushed groups.

Pushed groups will now appear in Addigy and can be used for device targeting and policy assignment.