# Configuring SCIM User Sync with Okta

> Configure SCIM User Sync between Okta and your UiPath organization in Test Cloud using OAuth2 or bearer token.

This page describes how to configure SCIM (System for Cross-domain Identity Management) User Sync between Okta and your UiPath organization.

:::note
**Public preview:** SCIM User Sync is currently in public preview.
:::

## Prerequisites

- An Enterprise or Enterprise Trial license for your UiPath organization.
- Admin permissions in both your UiPath organization and your Okta tenant.
- A working Security Assertion Markup Language (SAML) Single Sign-On (SSO) integration between Okta and UiPath. For setup instructions, refer to [Setting up Okta as your identity provider](https://docs.uipath.com/test-cloud/automation-cloud/latest/admin-guide/setting-up-okta-as-your-identity-provider).
- The same user set must be assigned to both the SAML SSO and SCIM applications.

## Before you begin

Set up SSO before you enable SCIM. For a new configuration, complete the steps in this order:

1. Create the application in Okta and configure SAML SSO with UiPath. See [Setting up Okta as your identity provider](https://docs.uipath.com/test-cloud/automation-cloud/latest/admin-guide/setting-up-okta-as-your-identity-provider).
2. Enable SCIM in UiPath (Step 1 below).
3. Configure SCIM in Okta (the remaining steps).

## Attribute mapping

The following user attributes are synchronized from your identity provider to UiPath. The **SCIM attribute** is the value sent by Okta; the **UiPath attribute** is where it is stored.

| SCIM attribute | UiPath attribute | Required |
| --- | --- | --- |
| `externalId` | Directory identifier used to match and link the user | Yes |
| `userName` | Username | Yes |
| `displayName` | Display name | Yes |
| `emails[type eq "work"].value` | Email | |
| `name.givenName` | First name | |
| `name.familyName` | Last name | |
| `title` | Job title | |
| `addresses[type eq "work"].locality` | City | |
| `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department` | Department | |
| `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:organization` | Company name | |

Okta populates `externalId` automatically, so you do not need to map it manually.

## Step 1: Enable SCIM in UiPath

1. Sign in to [cloud.uipath.com](https://cloud.uipath.com) using an account with organization admin permissions.
2. In the left-hand menu, select **Admin**, then select **Security**.
3. Under **Directory integration and single sign-on (SSO)**, select **Enable SCIM**.
4. Select one of the following authorization methods supported by Okta:
   - **OAuth2 authorization code grant** (recommended)
   - **Long-lived bearer token**
5. If you selected the **OAuth2 authorization code grant**, enter the **Redirect URL** (your identity provider's OAuth callback). Use the callback URL from [Okta's SCIM provisioning documentation](https://developer.okta.com/docs/guides/scim-provisioning-integration-prepare/main/), as the exact value depends on your Okta environment and application.
6. Select **Configure**.
7. Record the following values — you will need them when configuring Okta. Copy them exactly as shown in UiPath rather than constructing them by hand:
   - **SCIM URL** (for example, `https://cloud.uipath.com/{orgId}/identity_/api/scim/v2`)
   - If using the OAuth2 authorization code grant:
     - **Access token endpoint URI** (for example, `https://cloud.uipath.com/{orgId}/identity_/connect/token`)
     - **Authorization endpoint URI** (for example, `https://cloud.uipath.com/{organizationName}/identity_/connect/authorize?scope=PM.Scim&acr_values=tenantName:{organizationName}`)
     - **Client ID** and **Client Secret**
   - If using a long-lived bearer token: **Bearer token value**

:::note
Leave this browser tab open. Do not select **I have completed identity provider configuration** until you finish the steps in the following sections.
:::

## Step 2: Configure SCIM in Okta

1. Sign in to the Okta Admin Portal using an account with admin permissions.
2. Navigate to **Applications** and select the Okta application used to configure SAML with UiPath.
3. Enable SCIM provisioning:
   1. In the **General** tab, select **Edit** under **App Settings**.
   2. Under **Provisioning**, select **SCIM**.
   3. Select **Save**.
4. Configure the SCIM connection:
   1. In the **Provisioning** tab, select **Edit** under **Integration**.
   2. Set the following fields:

      | Field | Value |
      | --- | --- |
      | SCIM connector base URL | SCIM URL from Step 1 |
      | Unique identifier field for users | `userName` |

   3. Under **Supported provisioning actions**, select:
      - **Import New Users and Profile Updates**
      - **Push New Users**
      - **Push Profile Updates**
   4. Set the authentication mode:

      **OAuth 2 (recommended)**

      Set **Grant type** to **Authorization Code**, then complete the fields:

      | Field | Value |
      | --- | --- |
      | Authorization endpoint URI | Authorization endpoint URI from Step 1 |
      | Access token endpoint URI | Access token endpoint URI from Step 1 |
      | Client ID | Client ID from Step 1 |
      | Client Secret | Client Secret from Step 1 |

      **HTTP Header (bearer token)**

      | Field | Value |
      | --- | --- |
      | Authorization | Bearer token value from Step 1 |

   5. Select **Test Connector Configuration**.
   6. Verify that the connection test is successful.
   7. Select **Save**.
5. Enable provisioning features:
   1. In the **Provisioning** tab, select **To App**.
   2. Enable the following options:
      - **Create Users**
      - **Update User Attributes**
      - **Deactivate Users**
   3. Select **Save**.

## Step 3: Complete configuration in UiPath

Return to the UiPath browser tab from Step 1 and select **I have completed identity provider configuration**.

## Result

SCIM User Sync is now active between Okta and your UiPath organization. Users assigned to the application in Okta will be provisioned into UiPath automatically, and subsequent updates or deprovisioning events in your directory will be pushed to UiPath asynchronously.

To verify the setup, navigate to **Admin** > **Security** in UiPath and confirm that the SCIM status shows as enabled. You can also navigate to **Admin** > **Accounts and Groups** and confirm that provisioned users appear in the directory.