The Splunk Cloud application does not support System for Cross-domain Identity Management (SCIM) provisioning; it only supports on-premises provisioning. To enable SCIM provisioning for Splunk, a custom SCIM app needs to be created. This article discusses the options for enabling provisioning for the Splunk Cloud application. 

• Okta Integration Network (OIN)
• Provisioning
• Cross-domain Identity Management (SCIM)

The predefined Splunk Cloud application found in the OIN catalog currently only supports SAML; it does not support SCIM provisioning.

• According to the following Splunk documentation, a Splunk Admin has to select Enable SCIM provisioning in the SSO application.
  • The Splunk Cloud application in the OIN catalog does not support SCIM provisioning. 
  • Under the General tab, the only option is Enable on-premises provisioning.

• A custom SCIM application must be created instead to have the SCIM option appear under the General tab.

• • When creating a custom SCIM application, the sign-on method can be only SAML 2.0 or SWA—Secure Web Authentication Sign-in, as the custom OIDC application does not currently support SCIM.
  • To enable SCIM provisioning, follow the Add SCIM provisioning to app integrations documentation or the How to Enable SCIM Provisioning in Custom App Knowledge Base article.