This article explains how to set up SCIM provisioning from Okta to the Arcules Web Platform. For background on SCIM, token management and how provisioned users behave, see SCIM Provisioning Overview.

Supported features

Feature	Supported
Create users: users assigned to the Arcules app in Okta are created in Arcules	✅
Update user attributes: profile changes in Okta (name, email, language, phone) are updated in Arcules	✅
Deactivate users: users unassigned from the app, or deactivated in Okta, are deactivated in Arcules	✅
Reactivate users: users reassigned or reactivated in Okta are reactivated in Arcules	✅
Push groups: groups pushed from Okta are created in Arcules with their members; renames and membership changes are kept in sync	✅
Single sign-on (SAML 2.0): optional, configured separately. See Setting up SSO for your organization	✅
Import users or groups from Arcules into Okta	❌
Password sync	❌
Delete users (Okta only deactivates; see Known issues)	❌

Before you begin

Okta Lifecycle Management.Provisioning in Okta requires the Lifecycle Management feature.
SCIM enabled in Arcules with Okta selected. In the Arcules Web Portal, enable SCIM and select Okta as the identity provider. Copy the Secret Token. You'll paste it into Okta in Step 3. See Enabling SCIM.
Your Arcules region. You'll need it to set the Environment in Okta. It's shown in the SCIM URL in the Arcules Web Portal:

SCIM URL in Arcules	Environment in Okta
`https://scim.us.arcules.com/scim`	US
`https://scim.eu.arcules.com/scim`	EU
`https://scim.jp.arcules.com/scim`	JP

How Okta provisioning works

Okta uses two separate tabs, and they do different things:

Assignments decide which users are created in Arcules. Assigning a group here creates its members as users, but not the group itself.
Push Groups decides which groups are created in Arcules, and with which members.

To get a group and its members into Arcules, assign the group and push it.

Step 1: Create a SAML app

1. In the Okta Admin Console, go to Applications > Applications and click Create App Integration.

2. Select SAML 2.0 and click Next

3. Enter an App name (for example, Arcules) and click Next.

4. Under SAML Settings, enter the values for your Arcules region:

Region	Single sign-on URL	Audience URI (SP Entity ID)
Americas	`https://manage.arcules.com/federation/login/saml/assert`	`arcules.com`
EU	`https://manage-eu.arcules.com/federation/login/saml/assert`	`eu.arcules.com`
JP/APAC	`https://manage.jp.arcules.com/federation/login/saml/assert`	`jp.arcules.com`

Keep Use this for Recipient URL and Destination URL ticked.
Name ID format: EmailAddress.
Application username: Email.
Leave the advanced settings as they are.

5. Click Next. On the Feedback page, leave the optional questions blank and click Finish.

Single sign-on is optional. Okta requires these SAML values to create the app, but they have no effect until an IT Manager turns on SSO in Arcules (verified domain + Okta metadata). Until then, users sign in with an Arcules password. To turn on SSO later, using this same app, follow Setting up SSO for your organization.

Step 2: Use email as the username

Arcules uses the username Okta sends as the user's email address.

1. Open the Sign On tab and click Edit.

2. Under Credentials Details, check that Application username format is Email. Change it if needed.

3. Click Save.

Step 3: Connect Okta to Arcules

1. Open the General tab and click Edit in App Settings.

2. Under **Provisioning, select SCIM and click Save. A Provisioning tab appears.

⚠️ Select SCIM, not On-Premises Provisioning.

3. Open the Provisioning tab, select Integration and click Edit.

4. Enter:

Field	Value
SCIM connector base URL	The URL from the Arcules Web Portal
Unique identifier field for users	`userName`
Supported provisioning actions	Push New Users Push Profile Updates Push Groups Leave the Import options unticked
Authentication Mode	HTTP Header
Authorization	The Secret Token from the Arcules Web Portal.

Click Test Connector Configuration, and if all is well you will see the following screen. Click Save afterwards.

Step 4: Choose what Okta sends to Arcules

1. In the Provisioning tab, select To App and click Edit.

2. Enable:

- Create Users

- Update User Attributes

- Deactivate Users

3. Click Save.

Step 5: Check attribute mappings

Scroll down to Arcules Attribute Mappings on the To App page. The app comes with these mappings:

Arcules attribute	Okta attribute	Required
`userName`	Application username (Email, see Step 2)	Yes
`givenName`	`user.firstName`	Yes
`familyName`	`user.lastName`	Yes
`preferredLanguage`	`user.preferredLanguage`	No
`primaryPhone`	`user.primaryPhone`	No. Use international format, e.g. `+4512345678`

Every user needs an email, a first name and a last name, or Arcules can't create them. The default mappings should have these already set up, but verify they are set up correctly.

Step 6: Assign users

1. Open the Assignments tab and click Assign.

2. Choose Assign to People or Assign to Groups and select who should have access to Arcules.

3. Click Done.

Okta creates the assigned users in Arcules within a few minutes.

Step 7: Push groups

1. Open the Push Groups tab and click + Push Groups > Find groups by name.

2. Search for the group by its exact name, select it and click Save.

3. The group appears with Push Status Active. To sync it again immediately, open its menu and select Push now.

Notes

Only members who are also assigned to the app (Step 6) are added to the group in Arcules. The simplest way is to assign the same group in Step 6.
Groups arrive in Arcules without permissions. An IT Manager must assign permissions in the Arcules Web Portal. See How to manage users, groups & permissions.
To remove a group from Arcules, open its menu in Push Groups, select Unlink pushed group and choose Delete the group in the target app.

Removing users

When you unassign a user from the Arcules app, or deactivate them in Okta, Okta deactivates them in Arcules. Reassigning or reactivating the user in Okta reactivates them in Arcules.

Known issues

Okta never deletes users in Arcules. Even if you delete a user in Okta, they stay deactivated in Arcules. Because the user is managed by Okta, they can't be deleted from the Arcules Web Portal either.
The identity provider can't be changed after SCIM is enabled in Arcules. If SCIM was enabled with another identity provider selected, contact Arcules Support.
The Secret Token is valid for one year. When you refresh it in Arcules, paste the new token into Provisioning > Integration > API Token in Okta straight away. See Refreshing the SCIM token.

Troubleshooting

Symptom	Cause	Fix
No Provisioning tab, or no Enable API integration option	The Okta org doesn't have Lifecycle Management	See Before you begin
Test API Credentials fails	Wrong, expired or refreshed token, or the wrong Environment	Check the Environment matches your Arcules region, then refresh the token in Arcules and paste the new one
User isn't created	Username isn't an email, or first or last name is missing in Okta	See Step 2 and Step 5
Group is pushed but has no members	Members aren't assigned to the app	Assign them in Step 6
Group isn't created, only its users	The group was assigned but not pushed	Push it in Step 7
Deleted user still appears in Arcules	Expected: Okta only deactivates	See Known Issues

SCIM Integration with Okta