> ## Documentation Index > Fetch the complete documentation index at: https://docs.iru.com/llms.txt > Use this file to discover all available pages before exploring further. # SCIM Directory Integration with Okta > Configure SCIM directory integration between Okta and Iru Endpoint. Automatically provision and deprovision users and groups via the SCIM protocol. ### About SCIM Directory Integration with Okta SCIM Directory Integration with Okta in Iru Endpoint allows you to set up SCIM-based user directory synchronization between Okta and Iru Endpoint, enabling automatic user and group provisioning and deprovisioning. ### How It Works The SCIM integration creates a secure connection between Okta and Iru Endpoint, enabling automatic synchronization of user and group data. When users or groups are added, modified, or removed in Okta, these changes are automatically reflected in Iru Endpoint through the SCIM protocol. ### Prerequisites * Ensure you’re using Okta’s **Advanced Lifecycle Management** plan, which supports built-in, standards-based provisioning for SCIM. * Be sure to review the supported user and group attributes listed in the [SCIM Directory Integration](/en/endpoint/integrations/scim/scim-directory-integration#scim-schema-and-supported-attributes) article. ### Get the SCIM Token and API URL Complete these steps in Iru Endpoint first. You will need the SCIM access token and API URL when configuring Okta. For full details, see the [SCIM Directory Integration](/en/endpoint/integrations/scim/scim-directory-integration) article. In Iru Endpoint, click your name at the bottom of the left navigation, then select **Integrations**. Screenshot of the account menu with Integrations option highlighted Click **Discover integrations** in the upper-right of the Integrations page. On the **SCIM protocol** tile, click **Add and configure**. Add new integration page with SCIM protocol tile and Add and configure button Click **Get started**. Enter a unique name for the SCIM integration. Click **Generate token**. The SCIM integration uses an HTTP authorization header with a Bearer Token. Configure a SCIM user integration screen with name field and Generate token button Click **Copy token**. The token will not be visible again after you click Done. Store it securely, as you will need it in the **Okta** tab. Confirm that you have copied the token by checking the box, then click **Done**. You will return to the **Integrations** page. Copy token and configure with your identity provider dialog with Copy token button Click the **ellipsis** on the SCIM directory integration you created. Select **View Details**. Directory integrations list with SCIM integration and ellipsis menu showing View details, Rename, Rotate token, Delete Copy the SCIM API URL (e.g. `https://subdomain.api.iru.com/api/v1/scim`). Your identity provider will require this. The URL displayed in your tenant may still show the `api.kandji.io` domain. The `api.kandji.io` version of the SCIM API URL will also work for this purpose. Click **Close**. View user integration details modal with SCIM API URL and copy button Keep the token and API URL available, then switch to the **Okta** tab to create and configure the SCIM app integration. Complete the **Iru Endpoint** tab first to obtain the SCIM token and API URL. You will enter these in the steps below. ## Creating the SCIM Integration in Okta The Iru Endpoint application available in the Okta Integration Network (OIN) cannot be provisioned for SCIM. A new Application Integration must be created to leverage SCIM. This new app integration will not interfere with any existing Okta SSO integration leveraging the OIN Iru Endpoint application. Log in to your Okta admin console at login.okta.com. Once logged in, in the left-hand navigation, expand the **Applications** section and choose **Applications**. Click **Create App Integration**. Okta Applications page with Create App Integration button Select **SAML 2.0** as the application type and click **Next**. Create a new app integration dialog with SAML 2.0 selected In **General Settings**, give the app a **name** and check the box in the **App visibility** section. Then click **Next**. Create SAML Integration General Settings with app name and App visibility In **SAML Settings**, enter a placeholder URL in the **Single sign-on URL** and **Audience URI (SP Entity ID)** fields. Do not change any other settings. Create SAML Integration Configure SAML step with Single sign-on URL and Audience URI Click **Next**. In **Help Okta Support understand how you configured this application**, select the checkbox for **This is an internal app that we have created**, and click **Finish**. Create SAML Integration Feedback step with This is an internal app that we have created and Finish Since we will not be using this application integration for SSO, the URLs do not need to be valid; however, you must enter URLs in these fields to proceed. If you decide to enable SAML SSO in Iru Endpoint, you can use this same app to do so. ## Configuring SCIM Settings In the Okta SCIM app you just created, navigate to the **General** tab. In the **Settings** section, click **Edit**. Select **SCIM** in the Provisioning setting. Do not modify any other settings, and click **Save**. Okta General tab with SCIM selected in Provisioning setting In the **Provisioning** tab, click **Edit** in the Integration section. Okta Provisioning tab with SCIM Connection and Edit button For **SCIM connector base URL**, enter the SCIM API URL you copied from the **Iru Endpoint** tab (e.g. `https://subdomain.api.iru.com/api/v1/scim`). The `api.kandji.io` version of the SCIM API URL will also work for this purpose. For **Unique identifier field for users**, enter **userName**. For **Supported provisioning actions**, select **Push New Users**, **Push Profile Updates**, and **Push Groups**. For **Authentication Mode**, select **HTTP Header**. For **Authorization**, enter the Bearer Token you obtained in the **Iru Endpoint** tab. Click **Test Connector Configuration** to test the integration. Okta SCIM Connection with base URL, userName, provisioning actions, HTTP Header, and Bearer token In the list of detected features, confirm that only the following items display a checkmark to indicate success: * Create Users * Update User Attributes * Push Groups Okta Test Connector Configuration dialog showing Connector configured successfully and detected features Click **Save**. While still on the **Provisioning** tab, go to the **To App** section and click **Edit**. Okta Provisioning To App section with Provisioning to App and Edit In the **Provisioning to App** section, enable **Create Users**, **Update User Attributes**, and **Deactivate Users**. Okta Provisioning to App settings with Create Users, Update User Attributes, and Deactivate Users Click **Save**. (optional) In the **Attribute Mappings**, edit the user attributes to send to Iru Endpoint. Iru Endpoint will only store and use the attributes mentioned in the [SCIM Directory Integration](/en/endpoint/integrations/scim/scim-directory-integration#scim-schema-and-supported-attributes) article. ## Assigning Users to Iru Endpoint In Okta, the same group cannot be used on both the Assignments tab and the Push Groups tab. To avoid that conflict, create one assignment group for SCIM app access (for example, `iru_endpoint_users`) and keep it in sync with the users in your pushed groups. Then assign that assignment group to the SCIM app. This is one example of assigning users to Iru Endpoint through Okta SCIM. ### Create the assignment group In a new browser tab, navigate to **Directory > Groups** and click **Add Group**. Give the group a meaningful name like **iru\_endpoint\_users** and click **Save**. ### Add members with a group rule Use this when people in your push groups (for example, Sales and Engineering) should automatically become members of `iru_endpoint_users`. If you follow these steps, you do not need to bulk-add those users by hand. Go to Directory > Groups > Rules and click **Add Rule**. Okta Directory Groups Rules page with Add Rule Enter a rule name (for example, `Update iru_endpoint_users group membership`). Under IF, select **Use basic condition** and **Group membership**, then set **includes any of the following** and choose the groups you plan to push (for example, Sales and Engineering). Under **Then Assign to**, select `iru_endpoint_users`, then click **Save**. Okta group rule IF condition with Use basic condition and Group membership Back on the Rules page, open **Actions** for the new rule and click **Activate**. Okta Group Rules list with Actions menu and Activate ### Add members manually Use this when you are **not** using a group rule, for example, to add test users before push groups and rules are in place, or for people who must be in `iru_endpoint_users` but are not in any pushed group yet. Search for `iru_endpoint_users` and add the users who should have the SCIM app. ### Assign the group to the SCIM app Navigate back to the browser tab where the Okta SCIM app is open. Go to the **Assignments** tab, click **Assign > Assign to Groups**. Search for the newly created group and click **Assign** > **Save and Go Back**. Confirm that the group was assigned and click **Done**. The group should now appear in the Assignments tab's **Groups** section. If the group does not display, try refreshing the browser tab. All users in `iru_endpoint_users` are provisioned to Iru Endpoint and appear in the Users module. To sync groups for [conditional logic in Blueprints](/en/endpoint/blueprints/assignment-maps/using-conditional-logic-in-blueprints), continue with the next section. #### Pushing Groups to Iru Endpoint In this section, learn how to push user groups to Iru Endpoint. When planning to push Okta groups to Iru Endpoint for use with [conditional logic in Blueprints](/en/endpoint/blueprints/assignment-maps/using-conditional-logic-in-blueprints), for each group that you would like to push, add it to the **Push Groups** tab in the SCIM app. Per this [Okta article](https://help.okta.com/oie/en-us/Content/Topics/users-groups-profiles/usgp-about-group-push.htm), groups used to assign users in the Assignment tab cannot be used in the Push Groups tab. Okta recommends creating additional groups containing the same users and adding the new groups to the Push Groups tab for consistent group membership. If the same group is added in both places, the assignment tab will take precedence, and the group may not be pushed. One way to handle this is to create a single "user assignment" group containing all your Iru Endpoint users and add that group to the Assignment tab. From there, you can use your existing Okta groups as Push Groups. Remember that for the user-group association to work, the members of the pushed groups must also be members of the Iru Endpoint users group assigned to the SCIM app. ### Add groups on the Push Groups tab On the SCIM app, add every Okta group that should appear in Iru Endpoint. Open the Push Groups tab, click **Push Groups**, then **Find groups by name** (or **Find groups by rule**). Search for the group and select it. Select **Create Group**. Click **Save & Add Another**. Add any other groups to push to Iru Endpoint. ### Pushing Group Updates User and group syncing is one-way, meaning the SCIM app sends user and group data to Iru Endpoint only when there is new or updated data. For this reason, a "Sync Now" option is not needed in the Iru Endpoint Web App. * If you add users to the group assigned to the SCIM app in Okta, be sure to also update the groups you have added as Push Groups. * Updates should be seen in Iru Endpoint fairly quickly; to push group updates immediately, use **Push Now** on the Push Groups tab in Okta. See the [Okta article](https://help.okta.com/oie/en-us/content/topics/users-groups-profiles/usgp-enable-group-push.htm). ### Deleting Pushed Groups Use the following steps to stop pushing group updates or optionally delete a pushed group from Iru Endpoint. Go to the Push Groups tab for the app in Okta. In the Push Status column, select **Unlink push group**. Select **Delete the group in the target app (recommended)**. This removes the group in Iru Endpoint but does not delete user accounts. User accounts stay tied to the assignment group on the Provisioning tab. Click **Unlink**. You should no longer see the group listed on the Push Groups tab.