Skip to main content

​
Prerequisites

  • A SAML app integration for env zero in Okta. See Okta integration.
  • A SCIM endpoint URL and bearer token from env zero. See Set up SCIM.
  • Okta administrator access to the app integration.

​
Configure the SCIM connector

1

Enable SCIM on the app

In the Okta Admin Console, open the env zero app integration. On the General tab, under App Settings, click Edit, set Provisioning to SCIM, and save.
2

Enter the connector settings

Open the Provisioning tab. Under Settings > Integration, click Edit and set:
  • SCIM connector base URL: the SCIM Endpoint URL from env zero
  • Unique identifier field for users: userName
  • Supported provisioning actions: Push New Users, Push Profile Updates, and Push Groups
  • Authentication Mode: HTTP Header, with the env zero bearer token as the authorization value
Click Test Connector Configuration, then save.
3

Enable provisioning to env zero

Still on the Provisioning tab, select To App and click Edit. Enable Create Users, Update User Attributes, and Deactivate Users.
4

Check the user attribute mappings

In the To App attribute mappings, confirm that Username resolves to the user’s email address. env zero uses userName to match IdP users to organization members and rejects a create without it. Okta sends its own user identifier as externalId, which env zero also requires.Attributes env zero does not store are ignored rather than rejected, so a stock Okta mapping needs no trimming. See User attributes for what is stored.
5

Assign users

Assign users or groups to the app integration. Okta pushes each assigned user to env zero, and env zero adds them to the organization and any sub-organizations mapped to it.

​
Push groups to env zero teams

Group push creates an env zero team for each pushed Okta group and keeps its membership in sync. See Group to team mapping for the env zero side of the behavior.
1

Open Push Groups

In the app integration, open the Push Groups tab and click Push Groups.
2

Select groups

Choose Find groups by name or Find groups by rule, select the groups to push, and save. Each pushed group appears with a push status of Active.
3

Verify in env zero

Each pushed group appears as a team under Organization Settings > Teams, with the group’s members.

​
How Okta pushes groups

  • Okta sends group updates as PUT /scim/v2/Groups/{id} with the full group state, not PATCH.
  • Okta does not send externalId on group push, so env zero matches Okta groups by display name. Two Okta groups cannot map to one env zero team, and renaming a group in Okta renames the env zero team.
  • Members must already be provisioned in env zero. A push that carries an unassigned user fails on that member, so assign the user to the app integration before adding them to a pushed group.

​
Recover a group push mapping in Error state

Any non-2xx response from env zero puts the Okta push mapping into Error state, including the expected HTTP 409 when a pushed group’s name collides with an existing env zero team.
While a push mapping is in Error state, Okta stops pushing both profile and membership changes for that group. Reactivating the mapping does not replay the renames or membership changes made while it was errored, and Okta’s System Log reports the reactivation push as a success anyway. Replay the changes explicitly using the steps below.
1

Fix the underlying rejection

Read the error on the Push Groups tab. A name collision reads Conflict. Errors reported by remote server: A group named <name> already exists. Resolve it by renaming the Okta group, or by renaming or deleting the env zero team that holds the name.
2

Reactivate the mapping

On the Push Groups tab, activate the group again, either on its own row or through Bulk Edit. Okta reports success, but nothing that changed during the error window has been sent yet.
3

Replay membership changes

On the errored group’s row, use Push Now. This sends the group’s current membership, which brings adds and removes made during the error window into env zero.
4

Replay renames

Push Now does not replay a rename. If the group was renamed while the mapping was errored, rename it again in Okta, or rename it away and back, to trigger a fresh profile push.
5

Confirm in env zero

Check the team’s name and membership under Organization Settings > Teams. On the Enterprise plan, the audit log records every SCIM write with SCIM as the actor, so a missing entry means the push never reached env zero.

​
Troubleshooting

​
Next steps