---
title: "Provisioning LUSID using Okta and SCIM"
slug: "provisioning-lusid-using-okta-and-scim"
updated: 2024-09-23T12:26:03Z
published: 2024-09-23T12:26:03Z
canonical: "support.lusid.com/provisioning-lusid-using-okta-and-scim"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.lusid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Provisioning LUSID using Okta and SCIM

This article describes how to provision LUSID using [SCIM](https://en.wikipedia.org/wiki/System_for_Cross-domain_Identity_Management) when Okta is your identity provider. After you configure SCIM provisioning, you can manage LUSID user attributes and group memberships from Okta. [More about SSO](/v1/docs/using-sso-with-lusid).

A SCIM provisioning setup for LUSID using Okta supports the following features:

- **Push Users:** Users in Okta that are assigned to the LUSID application in Okta are automatically added as members to your domain in LUSID.
- **Update User Attributes**: User attributes that are updated in Okta are automatically updated in LUSID.
- **Deactivate Users**: Users that are deactivated in Okta are automatically deactivated in LUSID.
- **Import Users**: Users created in LUSID can be imported into Okta and either matched against existing Okta users or created as new Okta users.
- **Push Groups**: Groups and their members in Okta can be pushed to LUSID as LUSID roles.
- **Import Groups**: Import roles from LUSID as groups in Okta. Note that Okta does not allow you to manage memberships of these imported groups.
- **Profile Sourcing**: Allows LUSID to be a source for user profiles.

LUSID does not currently support the following Okta features:

- **Sync Password**

## Prerequisites

You must be assigned the required licences to use SCIM provisioning. To request these licences, contact [Technical Support](https://www.finbourne.com/contact/).

## Enabling SCIM provisioning in LUSID

To enable SCIM provisioning in LUSID, call the [AddScim](https://www.lusid.com/docs/api/identity/endpoints/identity-provider/AddScim) API. The example below shows a typical curl request where `<your-API-access-token>` is your [generated API access token](/v1/docs/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta).

```json
curl --request PUT 'https://<your-domain>.lusid.com/identity/api/identityprovider/scim' \
--header 'Authorization: Bearer <your-API-access-token>
```

The response contains the base URL and API token you must enter into Okta (see section below).

```json
{
  "baseUrl": "https://<your-domain>.lusid.com/identity/api/scim/v2",
  "apiToken": "ZWU5OWY1YWU1ODczNDkzYzgyYWY1NTVkMjB...U2YWYxNTgwMmQ1NGY1NmVlZjY3MmFiYTljMDk5OQ=="
}
```

## Enabling SCIM API integration in Okta

To enable SCIM API integration in Okta:

1. Log in to your Okta Admin dashboard and then add the **LUSID** application.
2. From the application, click the **Provisioning** tab and then click **Configure API Integration**: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/3c7c96c6-65d1-4389-ace1-8f95ca14ecdf.png)
3. Select **Enable API Integration**.
4. Enter the base URL and API token that were generated from the request to AddScim (see above): ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/bab8fdf0-e0e3-4300-a70e-f58ec2963cc1.png)
5. Click **Test API Credentials**. If the test passes, click **Save**.
6. Click **To App** under **SETTINGS**.
7. Click **Edit** and select **Enable** for the features you want to use: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/0aee6e44-dca5-4d2a-a6d5-83ec3fad64df.png)
8. Click **Save**.
9. If Profile Sourcing is required, click **To Okta**, scroll down to **Profile & Lifecycle Sourcing**, click **Edit** and then configure the settings that you require: ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/d0fe9c28-4990-44ef-b9f8-5518b8e6f524.png)

## Troubleshooting

### Groups as roles

Groups that are synced with LUSID via SCIM will appear as roles within LUSID's Identity service. These roles must be manually created within LUSID's Access service, and policies assigned to them. This can be done using the **Identity and Access > Roles** dashboard within the [LUSID web app](https://www.lusid.com/app/home), or programmatically via the [Access API](https://www.lusid.com/docs/api/access/intro).

### Contact

If you have any questions or difficulties with your LUSID SCIM integration, contact [Technical Support](https://www.finbourne.com/contact/).