> ## Documentation Index
> Fetch the complete documentation index at: https://docs.resolve.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta SCIM Provisioning

> Provision users and push groups from Okta to ResolveAI automatically.

Okta can provision users and push groups to ResolveAI. After you link a pushed group to a team, Okta keeps the team roster current.

<Info>
  An Okta Administrator must complete this setup. A ResolveAI organization admin must generate the credentials.

  Set up [Okta SSO](/okta) first. SCIM attaches to the same ResolveAI application.
</Info>

Before you start, read [Directory Sync (SCIM)](/directory-sync-scim) for the effects of each push and the required setup order.

## 1. Get your credentials from ResolveAI

In ResolveAI:

* Go to **Admin → Authentication**
* Find **Directory provisioning (SCIM)**
* Click **Generate SCIM credentials**

ResolveAI gives you:

* A **SCIM base URL**, of the form `https://api.app0.resolve.ai/scim/v2/i/<your-connection-id>`
* A **SCIM token**

<Warning>
  ResolveAI shows the token only when you create or rotate it. You cannot retrieve it later. Copy it before you leave the page. If you lose it, use **Rotate** to issue a replacement.
</Warning>

Use the plain base URL exactly as ResolveAI shows it. Okta does not need a query suffix.

## 2. Enable SCIM provisioning on the app

* In the Okta Admin Dashboard, open **Applications → Applications** and select your **ResolveAI** app
* On the **General** tab, click **Edit** next to **App Settings**
* Set **Provisioning** to **SCIM**
* Click **Save**

A **Provisioning** tab appears on the app once this is saved.

## 3. Configure the SCIM connection

Open the **Provisioning** tab, then **Integration**, and click **Edit**.

* **SCIM connector base URL**: the base URL from step 1
* **Unique identifier field for users**: `userName`
* **Supported provisioning actions**: enable **Push New Users**, **Push Profile Updates**, and **Push Groups**
* **Authentication Mode**: **HTTP Header**
* **Authorization**: `Bearer <your SCIM token>`

Click **Test Connector Configuration**, then **Save**.

<Info>
  ResolveAI identifies people by `userName`, which must contain the person's email address. Leave the unique identifier field set to `userName`.
</Info>

## 4. Enable provisioning to ResolveAI

Still on the **Provisioning** tab, choose **To App** in the left panel and click **Edit**.

Enable:

* **Create Users**
* **Update User Attributes**
* **Deactivate Users**

Click **Save**.

Deactivating a user in Okta freezes their ResolveAI account and ends their sessions immediately. It does not erase their history.

## 5. Check the attribute mappings

Under **To App**, confirm the ResolveAI attributes are mapped:

| ResolveAI attribute | Okta value       |
| ------------------- | ---------------- |
| `userName`          | `user.email`     |
| `givenName`         | `user.firstName` |
| `familyName`        | `user.lastName`  |

Only `userName` is required. A person with no first or last name is accepted and stored with those fields empty.

## 6. Assign people and sync them

* Open the **Assignments** tab
* Assign the users or groups who should have ResolveAI access

Okta pushes people when you assign them. In ResolveAI, confirm they appear in the imported directory under **Admin → Authentication**.

<Warning>
  Push users before groups. If a group names people ResolveAI does not have yet, ResolveAI stores the group push but refuses to reconcile the linked team. The team stays unchanged; it is not emptied.
</Warning>

## 7. Push groups

* Open the **Push Groups** tab
* Click **Push Groups** and select the groups you want ResolveAI to know about
* Leave **Push group memberships immediately** enabled
* Click **Save**

Pushed groups appear in the groups list under **Admin → Authentication**.

A pushed group does not change a team roster until you link it to that team.

## 8. Put the groups to work

Link groups to teams in ResolveAI, not Okta. See [Linking groups to teams](/scim-team-groups).

After you verify the directory, you can restrict sign-in to it. [Sign-in enforcement](/scim-sign-in-enforcement) previews who will gain or lose access.

## Troubleshooting

**Test Connector Configuration fails, or Okta reports HTML instead of JSON.** Check that the base URL matches the one ResolveAI displayed and uses the `api.` host. A URL built from the application host reaches the web app, not the SCIM service.

**"Email domain is not configured for this SCIM connection".** ResolveAI accepts only the email domains configured on your connection. Matching is exact and does not include subdomains. Map Okta to send an address on a configured domain, or ask your Resolve contact to add the domain.

**A group pushed, but the team did not change.** Confirm that every group member exists in ResolveAI. If ResolveAI cannot resolve all members, it stores the group push but refuses to reconcile the team. The team stays unchanged, and the Authentication page shows **Sync needs attention** with the reason.

**Someone was pushed but cannot use ResolveAI.** A pushed user is active in the imported directory, but the push does not grant access. Access begins when the user first signs in. Membership in a linked team is separate from organization access.

**Rotating a token.** **Rotate** issues a replacement and keeps the old token working for 24 hours while you update Okta. If a token may have leaked, use **Revoke** to stop it immediately.

**Group external IDs are empty.** Some providers send an external identifier with each pushed group. Okta does not, so that column stays empty in ResolveAI. The empty value does not affect syncing. Renaming a group in Okta pushes the new name to ResolveAI, and any linked team keeps its binding.