DeepakP.79075 (Customer) asked a question.
Setup:
- Custom SCIM 2.0 app integration in Okta (SAML SSO + SCIM provisioning).
- Users are created in our app only via SAML JIT on first login — we do not want SCIM to bulk-create users (users may sit in large Okta groups, but only those who actually log in should exist in our app).
- We do want SCIM-driven deprovisioning (deactivate on unassign/offboard).
What we're seeing:
- With "Create Users" OFF, assigning a user gives Automatic provisioning... failed: Matching user not found, and no link is established — so deprovisioning never fires.
- With "Create Users" ON, Okta does GET /Users?filter=userName eq "..." first and correctly links to an existing (JIT-created) user without POSTing — this works and enables deprovisioning.
- But for a user assigned via a group before they've logged in (so they don't exist in our app yet), the initial push fails. After they later JIT-login and exist in our app, Okta does not automatically re-drive the provisioning to establish the link — we have to manually Retry on Dashboard → Tasks.
Questions:
1. Is there a way to establish the SCIM linkage (externalId) needed for deprovisioning without enabling "Create Users" ?
2. Is there any automatic mechanism (scheduled import, event hook, Workflows, periodic reconcile) that re-drives a previously failed provisioning task once the JIT user exists — so we don't rely on manual "Retry Selected"?
3. Is "JIT-create + SCIM-deprovision-only" a supported pattern, or is the recommended approach to enable "Create Users" and have our SCIM endpoint link-or-upsert existing users?
Hi @DeepakP.79075 (Customer) , Thank you for reaching out to the Okta Community!
Please note that custom SCIM app implementations are the purview of our Okta Developer colleagues.
My advice would be to reach out via devforum.okta.com to take advantage of their expertise.
While we'll do our best to answer all of your questions here, this medium is more inclined towards Okta general questions around core products and features (non-custom/developer work).
That being said, based on my assessment of the use case, I can say that you cannot establish the SCIM linkage dynamically during group assignment if "Create Users" is disabled and the user hasn't logged in yet.
However, I would still recommend posting this question on the dedicated forum for SME feedback and if you are currently under contract with us, please feel free to open a support case to discuss the implementation in detail with a dedicated resource.
Regards.
--
Help others in the community by liking or hitting Select as Best if this response helped you.
Collect them all. Learn a new skill and earn a new Okta Learning badge.
Just released: More Okta Community badges just added