Overview of SCIM provisioning for Opti ID
Note
Optimizely officially supports SCIM provisioning with Entra ID, Okta, and PingOne. Other IdPs are not officially supported for SCIM provisioning, and Optimizely does not assist with custom configuration or troubleshooting.
You can configure an enterprise app integration in your identity provider (IdP) that uses System for Cross-domain Identity Management (SCIM) for provisioning. This securely automates and manages user identity information, such as user and group creation, updates, and deactivation from your IdP to Opti ID.
User and group provisioning with SCIM lets you manage your organization’s users and groups in one place and have those users and groups populate in Opti ID. Provisioning prevents the need to create a duplicate set of users and groups in Opti ID that already exist in your identity management service.
With Opti ID and SCIM, users and groups are first set up in your IdP and then provisioned to Opti ID. After you set up SCIM provisioning, changes you make to users and groups at the source IdP sync down to Opti ID using the SCIM protocol. You should not edit users and groups that SCIM provisioned into Opti ID directly in Opti ID. Instead, make changes to the users and groups at the source IdP, so you can sync these changes downstream into Opti ID with SCIM.
Supported provisioning features
Opti ID supports the following SCIM provisioning features:
- Push users – Users that you assign to the Opti ID SCIM application in your IdP are automatically added as users in Opti ID.
- Update user attributes – When you update user attributes in your IdP (like first and last names), they are updated in Opti ID.
- Deactivate users – When you deactivate users in your IdP or unassign them from the Opti ID application, they are deleted in Opti ID.
- Push groups – Groups and their users in your IdP are pushed to Opti ID.
Note
SCIM syncs only groups and users from your SSO. Instances, roles, and permissions are managed within the Opti ID Admin Center. When using SCIM provisioning, performing a group push creates internal groups in Opti ID.
Configure SCIM provisioning
You can configure SCIM provisioning with Entra ID, Okta, or PingOne. If you create multiple single sign-on SSO connections, you can only use SCIM for one of those SSO connections.
- Create a SCIM provisioning app in Microsoft Entra ID – Use OIDC or SAML for SSO, and manage SSO and SCIM on two separate Entra ID apps.
- Create a SCIM provisioning app in Okta – Use OIDC or SAML for SSO, and manage SSO and SCIM on two separate Okta apps.
- Create a single Okta app for SCIM provisioning and SAML SSO – Use only SAML for SSO, and manage SSO and SCIM on a single Okta app.
- Create a SCIM provisioning app in PingOne – Use OIDC or SAML for SSO, and manage SSO and SCIM on two separate PingOne apps.
For a visual representation of the processes that occur when you provision from SCIM to Opti ID, see SCIM provisioning workflow diagrams.
See also the APIs for SCIM provisioningAPIs for SCIM provisioning.