Articles on: Schools & enterprise plans

Set up SCIM provisioning with Okta for SimplyPrint

Set up SCIM provisioning with Okta for SimplyPrint


This guide walks you through connecting Okta to SimplyPrint over SCIM 2.0, so members are created, updated, and deactivated in SimplyPrint automatically whenever you change them in Okta. You'll enable provisioning on your SimplyPrint app in Okta, point it at SimplyPrint's SCIM base URL with a bearer token, then assign people and groups.


This is the Okta-specific setup guide. For what SCIM does, the requirements, how tokens and the grace period work, and the activity log, read the SCIM provisioning overview first. That article is also where you copy your SCIM base URL and create a token.


Before you start

SCIM needs single sign-on set up and active first. SCIM provisions the accounts; SSO is how those people actually sign in. Set up SAML or OIDC for your account, then come back here.


A few things to have ready:


  • SAML or OIDC single sign-on is connected and active for your account. See Set up single sign-on (SSO) for SimplyPrint.
  • A School or Enterprise plan (the plans that include SSO and SCIM).
  • An account admin with permission to manage user-registration settings in SimplyPrint.
  • Admin access to your Okta Admin Console, and an existing SimplyPrint app integration in Okta (the one you use for single sign-on).
  • Your SCIM base URL and a token, both from the SimplyPrint SCIM window. Open Settings, then Organization, then User registration, find the User provisioning section, and click Set up SCIM provisioning. Pick the Okta tab for an in-app summary of these steps, then use the Connection details section to copy the base URL and create a token.


Keep the SimplyPrint SCIM window open in one tab and the Okta Admin Console in another. You'll copy the base URL and token from SimplyPrint into Okta.


Create a token in SimplyPrint

You authenticate Okta to SimplyPrint with a bearer token.

  1. In the SimplyPrint SCIM window, go to the Connection details section.
  2. Enter a name you'll recognize later, for example "Okta", and click Create token.
  3. Copy the token straight away. It's shown only once and can't be retrieved again.


Copy the token value immediately. If you navigate away before copying it, you'll need to create a new one. You can keep up to five active tokens, so revoke an old one if you hit the limit.


Enable SCIM provisioning in Okta

SCIM is a per-app setting in Okta, so you turn it on for your SimplyPrint app.

  1. In the Okta Admin Console, go to Applications → Applications and open your SimplyPrint app.
  2. Open the General tab and edit App Settings.
  3. Under Provisioning, select SCIM, then save.


A Provisioning tab now appears on the app.


Enter the SimplyPrint connection details

  1. Open the app's Provisioning tab and select Integration.
  2. Click Edit.
  3. In SCIM connector base URL, paste your SimplyPrint SCIM base URL (it ends in /scim/v2). Use the exact value from the Connection details section.
  4. In Unique identifier field for users, select userName. SimplyPrint matches users by their username (typically the user principal name), so this should be the field Okta sends as the SCIM userName.
  5. Under Supported provisioning actions, tick Push New Users, Push Profile Updates, and Push Groups.
  6. For Authentication Mode, choose HTTP Header, then paste your SimplyPrint token into the Authorization → Bearer field.
  7. Click Test Connector Configuration, then Save.


A successful test confirms Okta can reach SimplyPrint and the token is valid. If it fails, re-check the base URL and make sure the token has no extra spaces.


Choose what Okta syncs

Still on the Provisioning tab, open To App and click Edit, then enable:


  • Create Users
  • Update User Attributes
  • Deactivate Users


Save. With these on, assigning someone to the app creates them in SimplyPrint, profile changes flow through, and removing or deactivating them in Okta deactivates them in SimplyPrint.


Push groups (optional)

To sync group memberships so they can drive SimplyPrint user groups (and become classes on school accounts):

  1. On the app, open the Push Groups tab.
  2. Click Push Groups and select the groups you want to send, by name or by rule.
  3. Save. Okta creates and keeps those groups in sync in SimplyPrint.


Pushed groups map to SimplyPrint user groups through your SSO group mappings, and on school accounts become classes. For how group names turn into user groups, permissions, and teacher status, see SAML single sign-on: user groups, group mapping, and teacher mapping. The same mappings apply to SCIM-provisioned users.


Assign people and groups

Provisioning only acts on people assigned to the app.

  1. Open the app's Assignments tab.
  2. Assign the users and groups you want in SimplyPrint.


As you assign people, Okta provisions them into SimplyPrint.


Verify it worked

Check the results in two places:


  • In Okta: the app's Provisioning logs and the Reports → System Log show each push and any error.
  • In SimplyPrint: scroll to the Activity section of the SCIM window. Every operation Okta performs - create, update, deactivate, and group sync - is logged with a timestamp, the operation, who it affected, the source, and whether it succeeded. A failed operation shows a red icon you can hover for the error.


Troubleshooting

  • Test Connector Configuration fails in Okta: confirm the SCIM connector base URL is the exact base URL from the Connection details section (ending in /scim/v2), that Authentication Mode is HTTP Header with the token in the Bearer field, and that the token was pasted without extra spaces. If in doubt, create a fresh token in SimplyPrint.
  • A user isn't appearing in SimplyPrint: check they're assigned to the app on the Assignments tab and that single sign-on is still active. Look at the Activity section in SimplyPrint for a failed create operation and its error.
  • Groups aren't becoming user groups or classes: confirm the group is added on the Push Groups tab and that your SSO group mappings match the group names Okta sends.
  • Someone was removed or blocked who shouldn't have been: deactivating or unassigning a user in Okta deactivates them in SimplyPrint, and full removal follows the grace period you set in SimplyPrint. Removal takes a member out of this account only - it doesn't delete their SimplyPrint account. See the grace period section in the SCIM provisioning overview.
  • Provisioning stopped after a token change: if you revoked or rotated the token in SimplyPrint, paste the new one into Okta's Bearer field. The old token no longer has access.



Updated on: 13/06/2026

Was this article helpful?

Share your feedback

Cancel

Thank you!