Is it possible to provision Okta admin roles via SCIM?

Hi @MyounghunP.12250 (Customer)​  , Thank you for reaching out to the Okta Community! 

To answer your questions:

Can Okta admin roles be assigned through SCIM user attributes (for example, using a roles attribute)?

>No. 

Or are Okta admin roles strictly managed internally within Okta and not exposed to SCIM provisioning?

>Yes. 

EDIT: In my initial answer I suggested leveraging Group rules. I have since been able to test this and confirmed that Group Rules cannot be used to automate the assignment, as a security precaution against accidental permission elevation Group membership rules cannot be created for groups with administrator roles. 

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added

Updating this response for ease of access and reference:

Administrators cannot provision or manage Okta administrator roles directly through System for Cross-domain Identity Management (SCIM) user attributes due to security boundaries that prevent privilege escalation. To automate Okta administrator role assignments, administrators must utilize group-based role assignments or the Okta Administrator Roles API.

Applies To

• Okta Identity Engine (OIE)
• Okta Classic Engine
• System for Cross-domain Identity Management (SCIM)
• Administrator Roles

Solution

Why does Okta restrict SCIM for administrator roles?

Okta intentionally decouples the administrative Role-Based Access Control (RBAC) framework from standard user profile synchronization. If Okta allowed a standard SCIM payload to map a roles attribute directly to Okta administrator permissions, a misconfiguration or compromise in the source directory could instantly result in catastrophic privilege escalation within the Okta tenant. Because of this security boundary, Okta does not expose administrator roles as standard writable attributes in the Okta SCIM endpoints.

How do administrators automate Okta administrator roles?

Automate Okta administrator role assignments by implementing group-based role assignments or utilizing the Okta Administrator Roles API.

• Group-Based Role Assignment: This approach utilizes an existing SCIM 2.0 integration without compromising the Okta security model. Create standard Okta groups and assign the corresponding Okta administrator roles to those groups. The SCIM client provisions users and updates the group memberships using the SCIM /Groups endpoint rather than updating a roles attribute. When the SCIM integration adds a user to the group, Okta automatically grants that user the assigned administrator role. When SCIM removes the user from the group, Okta instantly revokes the administrator privileges.
• Okta Administrator Roles API: If administrators cannot use groups and require direct user-level role assignment via an external system, build automation outside of SCIM using the Okta Representational State Transfer (REST) APIs. Execute POST requests to the Okta Role APIs to bind a specific user to a specific role. The legacy endpoint is /api/v1/users/{userId}/roles. For the Custom Administrator Roles feature, use the Resource Sets and Role Assignments endpoints to programmatically bind a user, a role, and a resource set together. Orchestrate this using a custom script, an Information Technology Service Management (ITSM) tool API call, or an Okta Workflow triggered by a user lifecycle event.

Summary

Automate Okta administrator role assignments using group memberships or the Okta Administrator Roles API instead of SCIM user attributes.

Regards.

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added