Okta SCIM Integration

Overview

SCIM (System for Cross-domain Identity Management) is an open standard for automating user provisioning. Learn Amp's SCIM integration with Okta provides a standardised way to sync user data between your identity provider and Learn Amp.

This is the recommended provisioning method for new implementations, using SCIM's defined schema for user information exchange.

💡 Tip: for an overview of provisioning options (including the legacy webhook method), see Okta User Provisioning.

Functionality Breakdown

Key Features

Standardised protocol – uses the industry-standard SCIM 2.0 specification.
Automated user lifecycle – create, update, and deactivate users automatically.
Universal Directory – use Okta as a single source of truth for identity management.
Secure data exchange – all communication uses HTTPS with API token authentication.

What SCIM Can Do

Action	Description

Action	Description
Create users	Automatically provision new users when added to the Learn Amp app in Okta
Update users	Sync profile changes from Okta to Learn Amp in real-time
Deactivate users	Disable access when users are removed from the app
Import users	Pull existing user data from Okta

Okta SCIM Integration requires SAML 2.0 for sign-in (SSO) alongside SCIM for provisioning — you'll configure both as part of a single app in Okta.

Pre-requisites

Before setting up Okta SCIM, ensure you have:

An Okta account with administrator access.
Administrator access to your Learn Amp account.
The SCIM + Okta integration enabled for your Learn Amp account (contact us to request this).

Role Requirements

The following Learn Amp roles can configure the Okta SCIM integration:

Owner – full access to all integration settings.
Admin – full administrative access to integration settings.

Quick Start Guide

Step 1: Access the Integration in Learn Amp

Sign in to Learn Amp as an Owner or Admin.
From the sidebar, select Settings.
Select Integrations.
Select SCIM + Okta.
Copy the API Token displayed — you'll need this for Okta configuration.

Step 2: Create the App in Okta

Sign in to your Okta admin account at okta.com.
Navigate to Applications → Create App Integration.
Select SAML 2.0 and select Next.
Enter an app name (e.g. "Learn Amp SCIM") and select Next.

Step 3: Configure SAML Settings

Setting	Value

Setting	Value
Single sign-on URL	Your Learn Amp URL (e.g. `https://yourcompany.learnamp.com`)
Audience URI (SP Entity ID)	`Learn Amp`
Application username	Email

Select Next, complete the short survey, then select Finish.

Step 4: Enable SCIM Provisioning

On the app page, go to the General tab and select Edit.
Under Provisioning, select SCIM.
Select Save.

Step 5: Configure SCIM Settings

On the new Provisioning tab, select Edit and enter:

Field	Value

Field	Value
SCIM connector base URL	Your Learn Amp subdomain + `/scim_v2`, e.g. `https://yourcompany.learnamp.com/scim_v2`
Unique identifier field for users	`email`
Supported provisioning actions	Import New Users and Profile Updates; Push New Users; Push Profile Updates
Authentication Mode	HTTP Header
Authorization	The API Token you copied from Learn Amp

Select Save.

Step 6: Enable Provisioning to App

In the Provisioning tab, select To App in the sidebar.
Select Edit on Provisioning to App.
Enable Create Users, Update User Attributes, and Deactivate Users.
Select Save.

Step 7: Configure Hire Date Mapping

By default, the SCIM basic schema (urn:ietf:params:scim:schemas:core:2.0:User) only covers basic attributes like first name, last name, and email. Learn Amp requires a hire date, which sits outside this basic schema, so you'll need to add a custom attribute in Okta:

In Okta, go to Directory → Profile Editor.
Select the SAML app profile you created above (for example, "Learn Amp SCIM").
Select Add Attribute.
Configure the attribute:

Field	Value

Field	Value
Display name	Hire Date
Variable name	`hireDate`
External name	`hireDate`
External namespace	`urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`

Select Save.

Once this attribute is mapped, hire date data will flow through to Learn Amp along with the rest of the standard fields.

Information That Can Be Synced

The SCIM integration maps these fields from Okta to Learn Amp:

Okta SCIM Field	Learn Amp Field

Okta SCIM Field	Learn Amp Field
`id`	`id`
`external_id`	`scim_external_id`
`userName` (email)	Email
`name.givenName`	First name
`name.familyName`	Last name
`title`	Job title
`department`	Primary team (matches or creates a team by name)
`manager.value`	Override manager (resolved by email within your company)
`hireDate` (custom, added above)	Hire date
`timezone`	Time zone (validated against Learn Amp's supported list; invalid values are silently ignored)

💡 Tip: additional mappings to Learn Amp custom fields are possible. Learn Amp creates the custom field, and you then map your Okta SCIM field to it. Contact your account manager to discuss your requirements — this may involve additional setup work and cost, particularly for anything beyond the standard fields above.

FAQs

Q: Do I need both SAML and SCIM?
Yes. SAML handles authentication (sign-in), while SCIM handles user provisioning (creating, updating, and deactivating users).

Q: Can I use SCIM without SAML SSO?
No. The Okta SCIM integration requires SAML for authentication. If you want provisioning without SAML, you'd need the legacy Okta integration with webhooks instead.

Q: Is there a daily sync with SCIM?
No. SCIM relies on push notifications from Okta when changes occur — there's no scheduled daily sync (unlike the legacy webhook method).

Q: What happens if a user is removed in Okta?
When you deactivate or unassign a user from the Learn Amp app in Okta, SCIM sends a deactivation request to Learn Amp, and the user's account is disabled.

Q: Can I migrate from the legacy integration to SCIM?
Yes, but contact Learn Amp Support first to ensure a smooth transition and prevent duplicate user accounts.

Troubleshooting

Issue	Solution

Issue	Solution
Users not provisioning	Verify the SCIM connector base URL is correct and includes `/scim_v2`. Check the API token is valid.
Authentication errors	Ensure the API token from Learn Amp is correctly pasted into Okta's Authorization field.
Hire date not syncing	Check the custom attribute is configured with the correct external namespace, exactly as shown above.
SCIM connection test fails	Verify your Learn Amp subdomain is correct in the base URL. Contact Support if the integration isn't enabled.
Users created but can't sign in	SAML SSO may not be configured correctly. Verify the Single sign-on URL and Audience URI settings.

⚠️ Warning: if you're migrating from the legacy Okta integration to SCIM, contact Learn Amp Support first to ensure a smooth transition and prevent duplicate user accounts.