How Group Linking Works for Okta SCIM Integrations
Last Updated:
API Access Management
Okta Classic Engine
Okta Identity Engine
Overview
Okta supports linking Okta groups with their corresponding groups for System for Cross-domain Identity Management (SCIM) integrations. Okta links groups automatically when group names match exactly, querying the SCIM server with a displayName filter to find a matching group. Alternatively, for integrations that support and have Import Groups enabled, an admin can use the Refresh App Groups button on the Push Groups tab to pull existing groups from the SCIM server and manually link a Push Group to one of them.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic
- System for Cross-domain Identity Management (SCIM)
- Provisioning
- SCIM 1.1 and 2.0
Solution
How Are Groups Linked Between Okta and a SCIM Service Provider?
There are two different ways that Okta supports Group Linking for SCIM integrations, which involves associating a Group within Okta with a Group on the Service Provider's side.
- Groups are linked based on their name. If the Group within Okta has the exact same name as the Group at the SCIM server, the groups will be automatically linked during Group Push. Okta will check if the group already exists on the Service Provider side by making a request to the SCIM server that will look like the following:
GET https://{scimUrl}?filter=displayName eq "{groupName}"
- If the SCIM integration supports and is configured in Okta with the option to Import Groups, the Refresh App Groups button on the Push Groups tab will allow Okta to make a request to the SCIM server's /Groups endpoint to retrieve the existing Groups on the Service Provider's side. Once these groups have been retrieved, there will be an option to link a Push group with one of these existing groups:
