> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.simplyprint.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Set up SCIM provisioning with Okta for SimplyPrint

# Set up SCIM provisioning with Okta for SimplyPrint

This guide walks you through connecting Okta to SimplyPrint over SCIM 2.0, so members are created, updated, and deactivated in SimplyPrint automatically whenever you change them in Okta. You'll enable provisioning on your SimplyPrint app in Okta, point it at SimplyPrint's SCIM base URL with a bearer token, then assign people and groups.

|| This is the Okta-specific setup guide. For what SCIM does, the requirements, how tokens and the grace period work, and the activity log, read the [SCIM provisioning overview](https://help.simplyprint.io/en/article/scim-provisioning-automatically-sync-users-from-your-identity-provider-1j9r556/) first. That article is also where you copy your SCIM base URL and create a token.

## Before you start
||| SCIM needs single sign-on set up and active first. SCIM provisions the accounts; SSO is how those people actually sign in. Set up SAML or OIDC for your account, then come back here.

A few things to have ready:

- **SAML or OIDC single sign-on is connected and active** for your account. See [Set up single sign-on (SSO) for SimplyPrint](https://help.simplyprint.io/en/article/set-up-single-sign-on-sso-for-simplyprint-4coj1g/).
- A **School or Enterprise plan** (the plans that include SSO and SCIM).
- An account admin with **permission to manage user-registration settings** in SimplyPrint.
- Admin access to your **Okta Admin Console**, and an existing SimplyPrint app integration in Okta (the one you use for single sign-on).
- Your **SCIM base URL** and a **token**, both from the SimplyPrint SCIM window. Open Settings, then Organization, then User registration, find the **User provisioning** section, and click **Set up SCIM provisioning**. Pick the **Okta** tab for an in-app summary of these steps, then use the **Connection details** section to copy the base URL and create a token.

| Keep the SimplyPrint SCIM window open in one tab and the Okta Admin Console in another. You'll copy the base URL and token from SimplyPrint into Okta.

## Create a token in SimplyPrint
You authenticate Okta to SimplyPrint with a bearer token.
1. In the SimplyPrint SCIM window, go to the **Connection details** section.
2. Enter a name you'll recognize later, for example "Okta", and click **Create token**.
3. Copy the token straight away. It's shown only once and can't be retrieved again.

||| Copy the token value immediately. If you navigate away before copying it, you'll need to create a new one. You can keep up to five active tokens, so revoke an old one if you hit the limit.

## Enable SCIM provisioning in Okta
SCIM is a per-app setting in Okta, so you turn it on for your SimplyPrint app.
1. In the Okta Admin Console, go to **Applications → Applications** and open your **SimplyPrint** app.
2. Open the **General** tab and edit **App Settings**.
3. Under **Provisioning**, select **SCIM**, then save.

A **Provisioning** tab now appears on the app.

## Enter the SimplyPrint connection details
1. Open the app's **Provisioning** tab and select **Integration**.
2. Click **Edit**.
3. In **SCIM connector base URL**, paste your SimplyPrint **SCIM base URL** (it ends in `/scim/v2`). Use the exact value from the **Connection details** section.
4. In **Unique identifier field for users**, select **userName**. SimplyPrint matches users by their username (typically the user principal name), so this should be the field Okta sends as the SCIM userName.
5. Under **Supported provisioning actions**, tick **Push New Users**, **Push Profile Updates**, and **Push Groups**.
6. For **Authentication Mode**, choose **HTTP Header**, then paste your SimplyPrint token into the **Authorization → Bearer** field.
7. Click **Test Connector Configuration**, then **Save**.

A successful test confirms Okta can reach SimplyPrint and the token is valid. If it fails, re-check the base URL and make sure the token has no extra spaces.

## Choose what Okta syncs
Still on the **Provisioning** tab, open **To App** and click **Edit**, then enable:

- **Create Users**
- **Update User Attributes**
- **Deactivate Users**

Save. With these on, assigning someone to the app creates them in SimplyPrint, profile changes flow through, and removing or deactivating them in Okta deactivates them in SimplyPrint.

## Push groups (optional)
To sync group memberships so they can drive SimplyPrint user groups (and become classes on school accounts):
1. On the app, open the **Push Groups** tab.
2. Click **Push Groups** and select the groups you want to send, by name or by rule.
3. Save. Okta creates and keeps those groups in sync in SimplyPrint.

Pushed groups map to SimplyPrint user groups through your SSO group mappings, and on school accounts become classes. For how group names turn into user groups, permissions, and teacher status, see [SAML single sign-on: user groups, group mapping, and teacher mapping](https://help.simplyprint.io/en/article/saml-single-sign-on-user-groups-group-mapping-and-teacher-mapping-lfgz7/). The same mappings apply to SCIM-provisioned users.

## Assign people and groups
Provisioning only acts on people assigned to the app.
1. Open the app's **Assignments** tab.
2. Assign the users and groups you want in SimplyPrint.

As you assign people, Okta provisions them into SimplyPrint.

## Verify it worked
Check the results in two places:

- **In Okta:** the app's **Provisioning** logs and the **Reports → System Log** show each push and any error.
- **In SimplyPrint:** scroll to the **Activity** section of the SCIM window. Every operation Okta performs - create, update, deactivate, and group sync - is logged with a timestamp, the operation, who it affected, the source, and whether it succeeded. A failed operation shows a red icon you can hover for the error.

## Troubleshooting
- **Test Connector Configuration fails in Okta:** confirm the **SCIM connector base URL** is the exact base URL from the **Connection details** section (ending in `/scim/v2`), that **Authentication Mode** is **HTTP Header** with the token in the **Bearer** field, and that the token was pasted without extra spaces. If in doubt, create a fresh token in SimplyPrint.
- **A user isn't appearing in SimplyPrint:** check they're assigned to the app on the **Assignments** tab and that single sign-on is still active. Look at the **Activity** section in SimplyPrint for a failed create operation and its error.
- **Groups aren't becoming user groups or classes:** confirm the group is added on the **Push Groups** tab and that your SSO group mappings match the group names Okta sends.
- **Someone was removed or blocked who shouldn't have been:** deactivating or unassigning a user in Okta deactivates them in SimplyPrint, and full removal follows the grace period you set in SimplyPrint. Removal takes a member out of this account only - it doesn't delete their SimplyPrint account. See the grace period section in the [SCIM provisioning overview](https://help.simplyprint.io/en/article/scim-provisioning-automatically-sync-users-from-your-identity-provider-1j9r556/).
- **Provisioning stopped after a token change:** if you revoked or rotated the token in SimplyPrint, paste the new one into Okta's **Bearer** field. The old token no longer has access.

## Related articles
- [SCIM provisioning overview](https://help.simplyprint.io/en/article/scim-provisioning-automatically-sync-users-from-your-identity-provider-1j9r556/)
- [Set up Okta single sign-on (OIDC) for SimplyPrint](https://help.simplyprint.io/en/article/set-up-okta-single-sign-on-oidc-for-simplyprint-1hbzagz/)
- [Set up single sign-on (SSO) for SimplyPrint](https://help.simplyprint.io/en/article/set-up-single-sign-on-sso-for-simplyprint-4coj1g/)
- [SAML single sign-on: user groups, group mapping, and teacher mapping](https://help.simplyprint.io/en/article/saml-single-sign-on-user-groups-group-mapping-and-teacher-mapping-lfgz7/)
- [Cleaning up and removing users from your account](https://help.simplyprint.io/en/article/cleaning-up-and-removing-users-from-your-account-1e2a42y/)