AkhileshN.50943 (Customer) asked a question.
How can I enable SCIM provisioning for only one AD group while maintaining SSO for multiple groups in a Salesforce integration?
We have a Salesforce app integrated with Okta using SAML SSO and SCIM provisioning. Two AD groups are assigned to this app:
- Group X (requires SSO only, no provisioning)
- Group Y (requires both SSO and SCIM provisioning)
SSO is working correctly for both groups. We now want to enable SCIM provisioning only for users in AD Group Y, while ensuring that Group X continues to have access via SSO but is excluded from SCIM provisioning actions (create, update, deactivate).
The Provisioning tab in the Salesforce app in Okta doesn’t seem to offer a way to filter provisioning actions by group.
My questions:
- Is there a supported way to scope SCIM provisioning to only apply to Group Y?
- Can this be done using assignments, Group Push, or other configuration steps?
- Is there a best practice to ensure Group X users are excluded from provisioning, but still retain SSO access?
Hi @AkhileshN.50943 (Customer) , Thank you for reaching out to the Okta Community!
While there is no out-of-the-box filtering for Provisioning feature, you might be able to achieve this by setting up two instances of the Salesforce app in Okta.
It's my understanding that Salesforce supports multiple IDPs, so in essence you would use the same Okta tenant but with two different SSO configuration.
⚠️ If you have a preview/sandbox environment, I strongly recommend testing this there instead of Production.
The breakdown would be like this:
In Okta: You'll have two distinct Salesforce apps.
In Salesforce: You'll have two distinct SAML Single Sign-On configurations.
If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Just released: More Okta Community badges just added
Join the discussion for our Ask Me Anything on September 29, 2025: Device Assurance. Ask our expert questions.
@Mihai Negoita - Okta (Okta, Inc.) Thanks for your response. I have a concern with this approach though!
If we proceed with the two-apps approach, I’m concerned it might affect the end-user login experience, as users may be unsure which Salesforce app to choose during SSO. How do you recommend controlling that?
Since AD Group X already has existing users, we want to ensure their login experience remains unchanged and seamless.
Is there any way to achieve this within a single Salesforce application in Okta? Specifically, can we add a condition or filter to enable SCIM provisioning for only one AD group while keeping SSO active for both?
This should not be a problem as users only see the app tile assigned to them in their Okta Dashboard not all Salesforce app integrations in the org.
If Group X already exists and uses the app for SSO only, you would leave them as is and you would have to create a new Salesforce app integration (give it another name/label) with SSO+Provisioning and only assign the other group.
The single app approach is not possible as there is no feature/option for this - Provisioning is enabled at app level not user/group level.
I recommend opening a case to go over your configuration with my colleagues from the Okta Support team to discuss details and possible variables.
Regards,
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Just released: More Okta Community badges just added
Join the discussion for our Ask Me Anything on September 29, 2025: Device Assurance. Ask our expert questions.
I agree with the 2 app approach, but I would consider making one of your apps the SSO Only app, and the other the Provisioning Only app. All your users needing SSO will be assigned to the SSO Only app and only the SCIM users will be assigned to the Provisioning Only app (and this app would be hidden from your users).
With this approach, you could have 2 groups, one for Only SSO and one for Provisioning/SSO. The ONLY SSO group would be assigned to your SSO Only app and the Provisioning/SSO group would be assigned to both apps so when they are added to the group, they are added to both apps.
You have to do two separate apps for this if you want to do it that way. You can start with 2 apps then move to 1 app later. Or you can just have 2 apps and make sure the groups accross them are the same. ive done that many times and its fine