How to configure SCIM 2.0 provisioning with Okta ?

Jennifer Biscoe

04 March 2026 14:35

SCIM 2.0 is a protocol designed for secure provisioning and lifecycle managements of users and groups between systems. In this article, we will go over the configuration of SCIM provisioning between Okta and the Scaleflex VXP.

Prerequisites

Okta IAM administrator access
SAML 2e.0 with Okta configured. See How to configure SAML 2.0 SSO with Okta ?
Scaleflex VXP Administrator access
SCIM provisioning is included in any VXP license

Supported features

Create users
Update user attributes
Deactivate users
Import users
Import groups
Group push

The organization VXP Owner and VXP Administrators cannot be managed via SCIM. This is an intended security restriction.

Configuration steps

In the Scaleflex VXP Hub, navigate to Settings > Organisation > General
In the Access Management section, click on the Generate button:

A SCIM token will be generated and displayed only once for you to copy (store it safely as you won't be able to see it again later):
In Okta, navigate to the Scaleflex VXP App. Under the Provisioning paste the API token and click on Test Credentials. Make sure the connection is succesful.
Navigate to the Assignments tab and review your assignments. We recommend using groups to assign users (1 group per user role in the Scaleflex VXP) to the application in Okta:
Navigate to Push Groups and select the groups to push into the Scaleflex VXP. This is a required step as the user's profile assignment in the VXP is managed through groups (see step 8):
Verify that the group has been created in the VXP as a team under Settings > Organisation > Teams. You can filter out the SCIM users and teams via the dedicated toggle, which shows as soon as there is at least one SCIM user or team:
Edit the team to assign a user profile to members of this team:
Repeat steps 6,7 and 8 for any additional group you want to manage as a team in the Scaleflex VXP.
Users assigned to the Okta app via groups-based assignment will be provisioned in the Scaleflex VXP and assigned the user profile mapped to the team in step 8.