---
title: SCIM provisioning with Okta
sidebarTitle: SCIM
description: With SCIM (System for Cross-domain Identity Management) enabled, you can automate user provisioning in Cube Cloud and keep user groups synchronized with Okta.
---

<Note>

Available on [Enterprise plan](https://cube.dev/pricing).

</Note>

## Prerequisites

Before proceeding, ensure you have the following:

- Okta SAML authentication already configured. If not, complete
  the [SAML setup][ref-saml] first.
- Admin permissions in Cube Cloud.
- Admin permissions in Okta to manage application integrations.

## Enable SCIM provisioning in Cube Cloud

Before configuring SCIM in Okta, you need to enable SCIM
provisioning in Cube Cloud:

1. In Cube, navigate to **Admin → Settings**.
2. In the **SAML** section, enable **SCIM Provisioning**.

## Generate an API key in Cube Cloud

To allow Okta to communicate with Cube Cloud via SCIM, you'll need to
create a dedicated API key:

1. In Cube Cloud, navigate to **Settings → API Keys**.
2. Create a new API key. Give it a descriptive name such as **Okta SCIM**.
3. Copy the generated key and store it securely — you'll need it in the
   next step.

## Enable SCIM provisioning in Okta

This section assumes you already have a Cube Cloud SAML app integration
in Okta. If you haven't created one yet, follow the
[SAML setup guide][ref-saml] first.

1. In the Okta Admin Console, go to **Applications → Applications**
   and open your Cube Cloud application.
2. On the **General** tab, click **Edit** in the
   **App Settings** section.
3. Set the **Provisioning** field to **SCIM** and click
   **Save**.

## Configure SCIM connection in Okta

1. Navigate to the **Provisioning** tab of your Cube Cloud application.
2. In the **Settings → Integration** section, click **Edit**.
3. Fill in the following fields:
   - **SCIM connector base URL** — Your Cube Cloud deployment URL with
     `/api/scim/v2` appended. For example:
     `https://your-deployment.cubecloud.dev/api/scim/v2`
   - **Unique identifier field for users** — `userName`
   - **Supported provisioning actions** — Select **Push New Users**,
     **Push Profile Updates**, and **Push Groups**.
   - **Authentication Mode** — Select **HTTP Header**.
4. In the **HTTP Header** section, paste the API key you generated
   earlier into the **Authorization** field.
5. Click **Test Connector Configuration** to verify that Okta can
   reach Cube Cloud. Proceed once the test is successful.
6. Click **Save**.

## Configure provisioning actions

After saving the SCIM connection, configure which provisioning actions
are enabled for your application:

1. On the **Provisioning** tab, go to **Settings → To App**.
2. Click **Edit** and enable the actions you want:
   - **Create Users** — Automatically create users in Cube Cloud when
     they are assigned in Okta.
   - **Update User Attributes** — Synchronize profile changes from Okta
     to Cube Cloud.
   - **Deactivate Users** — Deactivate users in Cube Cloud when they are
     unassigned or deactivated in Okta.
3. Click **Save**.

## Assign users and groups

For users and groups to be provisioned in Cube Cloud, you need to assign
them to your Cube Cloud application in Okta. This is also required for
group memberships to be correctly synchronized — pushing a group alone
does not assign its members to the application.

1. In your Cube Cloud application, navigate to the **Assignments** tab.
2. Click **Assign** and choose **Assign to Groups** (or
   **Assign to People** for individual users).
3. Select the groups or users you want to provision and click **Assign**,
   then click **Done**.

<Warning>

If users were assigned to the application before SCIM provisioning was enabled,
Okta will show the following message in the **Assignments** tab:
*"User was assigned this application before Provisioning was enabled and not
provisioned in the downstream application. Click Provision User."*

To resolve this, click **Provision User** next to each affected user.
This will trigger SCIM provisioning for them without needing to remove and
re-add their assignment.

</Warning>

## Push groups to Cube Cloud

To synchronize groups from Okta to Cube Cloud, you need to select which
groups to push:

1. In your Cube Cloud application, navigate to the **Push Groups** tab.
2. Click **Push Groups** and choose how to find your groups — you can
   search by name or rule.
3. Select the groups you want to push to Cube Cloud and click **Save**.

## Default role for SCIM-provisioned users

Users created through SCIM receive the same default role configured for
SAML auto-provisioning — there is no separate SCIM control. By default
this is the **Viewer** role; to choose a different default role (including
[custom roles][ref-custom-roles]), see
[Default role for new users][ref-saml-default-role] on the SAML setup page.

The default role only applies to users created by SCIM (`POST
/api/scim/v2/Users`). Existing users are not modified by subsequent SCIM
profile updates.

## Map roles by SCIM group

If you have configured [Map roles by group][ref-saml-map-roles-by-group]
on the SAML setup page, the same mapping is applied when SCIM pushes
group memberships from Okta — when Okta adds a user to a pushed group,
Cube Cloud assigns the mapped role to that user. Role assignment is
**additive**: removing a user from an Okta group does not strip the
corresponding role; adjust the user's roles in Cube Cloud manually.

No separate configuration is required on the SCIM side — once the
mapping is defined on the SAML page, it drives both SAML SSO and SCIM
group sync. Match is on the group **display name** Okta pushes
(case-insensitive).

[ref-saml]: /admin/sso/okta/saml
[ref-saml-default-role]: /admin/sso/okta/saml#default-role-for-new-users
[ref-saml-map-roles-by-group]: /admin/sso/okta/saml#map-roles-by-group
[ref-custom-roles]: /admin/users-and-permissions/custom-roles