This article will guide you through enabling SCIM user provisioning in your Survicate organization with Okta. With SCIM, Okta automatically manages your Survicate users: accounts are created when people get access in Okta, updated when their details change, and deactivated when they leave.

❗️To enable SCIM provisioning for your organization, contact your Customer Success Manager.

What is SCIM provisioning?

SCIM (System for Cross-domain Identity Management) lets Okta manage Survicate users automatically.
When people are assigned to the Survicate app in Okta, a Survicate account is created for them before they first sign in, with no manual invitation needed.
Roles, workspace access, and Insights Hub access are controlled through group mapping rules that you set up in Survicate.
Okta groups appear in Survicate as Teams, making it easy to use them in folder permissions.
Currently supported with Okta only.

Before you start

Your Okta plan must include Lifecycle Management, which is required for SCIM provisioning in custom apps. If SCIM isn't available under Provisioning on the General tab of your Survicate app in Okta, contact Okta support to confirm your plan includes this feature.
SAML single sign-on must be set up and turned on first. Read the Okta configuration guide if you haven't done this yet. SCIM cannot be enabled while SAML is off, and people provisioned by SCIM sign in only through SSO and have no Survicate password. When you turn on SCIM provisioning, Passwordless authentication (on the SAML Authentication tab) is turned on automatically and stays on while SCIM is on, because provisioned people sign in only through SSO. You can't turn SAML off while SCIM provisioning is on; turn SCIM provisioning off first.
Only the organization owner can set up SCIM, the same as SAML.

Step 1: In Survicate

1. Go to Settings ➡️ Single Sign-On ➡️ SCIM Provisioning tab and toggle Enable SCIM provisioning on.

2. Under Connection details, copy the SCIM Base URL.

3. Under Token management, click Generate token. The full token appears only once, so copy it immediately. Later, you can:

Rotate it (replaces it; paste the new one into Okta)
Revoke it (syncing stops; users, Teams, and rules remain)

4. While SCIM is on, the SAML tab's toggle "Grant access to all workspaces when inviting users through SSO" is turned off and disabled, because mapping rules control access.

Step 2: Add group mapping rules (recommended before connecting Okta)

Group mapping rules tell Survicate which roles and workspace access to give people based on their Okta groups. It's best to set these up before connecting Okta to avoid confusion.

1. Under Group mapping rules, click Add mapping rule and fill in:

Identity provider group: the group name exactly as it appears in Okta (case-sensitive)
Role: Admin or User (Guest is not available through SCIM)
Workspaces: specific workspaces, or All workspaces
Grant Insights Hub access (optional): check to give this group access to Insights Hub in the selected workspaces

2. If someone is in several groups, they get:

The highest role in each workspace
Insights Hub access if any of their rules grant it

3. People whose groups match no rule are created without workspace access until a matching rule is added later.

4. Adding, editing, or deleting a rule updates everyone in that group within a few minutes. There's no confirmation step when deleting a rule, so be careful: deleting removes the access that rule gave.

5. Rules match the group name. If you rename a group in Okta, rename its mapping rule in Survicate too. Until you do, people in that group lose the access the rule gives.

Step 3: In Okta

In the Okta Admin Console, go to Applications ➡️ Applications and Resources and click your Survicate app's name - the same Survicate app you created in Okta when setting up SAML single sign-on.

1. Sign On tab:

Make sure Application username format is set to Email, because Survicate matches people by email.

2. General tab → App Settings → Edit:

Under Provisioning, select SCIM ➡️ Save.

3. Provisioning tab → Integration → Edit:

SCIM connector base URL: paste the SCIM Base URL from Survicate
Unique identifier field for users: userName
Supported provisioning actions: check Push New Users, Push Profile Updates, and Push Groups
Authentication Mode: select HTTP Header
Paste the token from Survicate as the Bearer token
Click Test Connector Configuration, then Save.

4. Provisioning tab → To App → Edit:

Turn on Create Users, Update User Attributes, and Deactivate Users ➡️ Save.

5. Assignments tab:

Assign the groups (or people) who should have access to Survicate.

6. Push Groups tab:

Push the groups you mapped in Survicate. Group membership is what gives people their roles, so this step is required for provisioning to work.

What happens automatically

User provisioning

People assigned in Okta get a Survicate account automatically before they first sign in. In the Teammates list, they show a "Synced" badge.
Their access appears once their groups are pushed to Survicate.
Name and email changes in Okta update Survicate automatically.
Adding or removing someone from a group in Okta updates their access and Team membership within a few minutes.

Deactivation and reactivation

If someone is deactivated in Okta, unassigned from the app, or deleted, their Survicate account becomes Deactivated: they can't sign in or access anything.
Deactivated people stay in the Teammates list with their history, and surveys they created remain.
Reactivating them in Okta restores access based on their current groups.

Teams and group management

Okta groups appear as Teams labeled "Synced", one in each workspace the group's rule covers.
Team membership is managed in Okta and can't be edited in Survicate, but you can use these Teams in folder permissions.

Linked accounts

People already in Survicate with the same email are linked, not duplicated, and keep their current access until a matching rule applies to them.

Details managed in Okta

Synced people's name, email, roles, and Hub access are read-only in Survicate (marked as "Managed by your identity provider").
To change these, edit them in Okta.
To remove a synced person, remove them in Okta. Once they're deactivated, you can also remove them from Survicate entirely.

Manual invites and SCIM

People you invite manually (e.g., external agencies) aren't affected by SCIM and are managed as usual.

Sync status

The status line on the SCIM Provisioning tab shows how many users and groups are synced and when Okta last sent a change.

Seats and plan limits

Provisioned people with the Admin or User role count toward your plan's seats.
If a new person would exceed your seat limit, they're added as "Deactivated · seat limit reached" and a banner appears on the SCIM Provisioning tab.
They're activated automatically when a seat frees up or you upgrade your plan.

Turning SCIM off

Syncing stops. Nobody is deactivated.
Synced people keep their current roles and access, but their details and roles stay locked in Survicate ("Managed by your identity provider"). To change them again, turn SCIM provisioning back on.

Troubleshooting

Problem	Solution
Okta's connection test fails	Check that the SCIM Base URL was copied exactly and the token is current. If you clicked Rotate or Revoke in Survicate, paste the new token into Okta.
Someone has no access	Check that their Okta group is pushed to Survicate and the group name matches a mapping rule exactly (case-sensitive).
Someone shows "seat limit reached"	Free up a seat (for example, deactivate someone in Okta or remove a teammate who no longer needs access), or upgrade your plan.
Access didn't update after editing a rule	Changes can take a few minutes to sync. Wait a moment and refresh.
A group shows an error on Okta's Push Groups tab	Open the group to see the error message. If it persists, contact support@survicate.com.
People lost access after a group was renamed in Okta	Rename the group's mapping rule in Survicate to the new name.
Someone sees a "Connect to Survicate" page after signing in with Okta	Their Survicate account also belongs to another Survicate organization, or has a pending invitation to one, so Survicate can't sign them in directly. They can use "Forgot password" on the Survicate login page to set a password, then sign in with SSO and enter that password (or use Google) on the "Connect to Survicate" page. They'll need to do this whenever they aren't already signed in. To avoid it, use a separate Survicate account, with a different email, for each organization.

📞 If you have any questions or need assistance - feel free to reach out to our team via chat or email: support@survicate.com.

SCIM user provisioning with Okta