Set up SCIM user provisioning: Okta

Important information:

• Okta has separated how groups are assigned to applications and how user's group memberships are provisioned to downstream applications. Group memberships are synchronized to applications via the concept called "Push groups". For more information, see Okta's documentation on managing applications and group assignments.
• SCIM operations in Okta are done immediately. When provisioning is enabled, users will be provisioned when given access to DeepL and their group memberships will be updated accordingly.
• To understand how Okta manages users throughout the provisioning lifecycle, see Okta's own documentation.

Limitations:

• SCIM provisioning with Okta is only available for SAML integrations. This is due to Okta enforcing developers to create integrations which become part of the public Okta Integration Network, allowing anyone to set up SCIM in Okta with OIDC. This requires a process where Okta confirms the SCIM integration works before publishing to their network.
• Admins cannot be managed via SCIM. If a user is provisioned via SCIM and then promoted to Admin, it won't be possible to continue managing that user via SCIM. We are working on removing this limitation in future releases.
• Existing accounts not associated with your organization cannot be imported into your organization during SCIM provisioning.
• Email update operations cannot be completed if used in conjunction with Email NameID policy format. This is only applicable to SSO configurations using SAML.

Prerequisites

• Admin access to DeepL
• Single sign on (SSO) is setup for DeepL. If you haven't set up SSO, follow the instructions.
  • OpenID Connect
  • SAML
• Remove JIT group synchronization and groups, if it was enabled in a previous setup. Follow the instructions in this article.
• SCIM provisioning with Okta is currently only available for SAML integrations. This is due to Okta enforcing developers to create integrations which become part of the public Okta Integration Network, allowing anyone to set up SCIM in Okta with OIDC. This requires a process where Okta confirms the SCIM integration works before publishing to their network.

Enable SCIM in DeepL account

1. Go to the Settings of your DeepL account
2. In section Team and User provisioning configuration, click Manage user provisioning

3. Select Enable SCIM provisioning
   An SCIM admin API key is created. You need this API key for your configuration in Entra ID. 

   If you've previously set up JIT group synchronization, make sure to disable it to avoid any user provisioning issues. Before disabling JIT group synchronization, export your existing groups and users. 

Set the SCIM configuration in Okta

Create the connection

1. Go to your Okta admin console and navigate to your DeepL application under Applications.
2. Select the General tab.
3. In the App Settings section, click Edit.
4. Enable SCIM provisioning and click Save.
5. Select the Provisioning tab that now appears.
6. Click Edit in the SCIM Connection section.
7. Enter the following information:
   • SCIM connector base URL: https://scim.deepl.com
   • Unique identifier field for users: userName
   • Supported provisioning actions: Select Push New Users, Push Profile Updates, and Push Groups
   • Authentication Mode: Select HTTP Header
   • Authorization: Enter your SCIM API key (found in your DeepL admin account under Admin keys. For more information, see this article.)
8. Click Test Connector Configuration to verify the connection.
9. Once the test is successful, click Save.

Assign users and groups

If you already assigned users and groups to the application during the SSO setup, you can move to the next section.

1. In your DeepL application, select the Assignments tab.
2. Click Assign and choose either Assign to People or Assign to Groups.
3. Select the users or groups you want to provision to DeepL.
4. Click Assign and then Done.

Configure the provisioning scope

1. In your DeepL application, select the Provisioning tab.
2. Click Edit in the Provisioning to App section.
3. Enable the following options:
   • Create Users: Automatically create users in DeepL when they are assigned to the application
   • Update User Attributes: Update user attributes in DeepL when they change in Okta
   • Deactivate Users: Deactivate users in DeepL when they are unassigned from the application or deactivated in Okta
4. Click Save.

Configure attribute mapping

Okta provides default attribute mappings for SCIM provisioning. You can customize these mappings if needed:

1. In your DeepL application, select the Provisioning tab.
2. Click Go to Profile Editor.
3. Review and modify the attribute mappings as needed.
4. Click Save Mappings.

Download provisioning logs

To troubleshoot provisioning issues or verify successful operations:

1. In your Okta admin console, go to Reports > System Log.
2. Filter by your DeepL application and provisioning events.
3. Click on individual events to view detailed information.
4. To export logs, click Download CSV or use the Okta API to retrieve logs in JSON format.

For more information about Okta provisioning logs, please see Okta's own documentation.