Configure SCIM with Okta

• First name
• Last name
• Email
• Title
• Employee number
• Location
• Manager ID
• Start date
• Hire date
• Termination date
• Custom attributes
• Group ID
• Group name
• Group members

1. In Okta, navigate to the Provisioning tab > To App subtab and make sure the following settings are enabled:
   • Create Users Update
   • User Attributes Deactivate
   • Users Sync Password (optional): Read through the section entitled Syncing Passwords in this guide to decide if you would like to have Okta sync passwords with 15Five.
2. Map your attributes to the corresponding fields in 15Five using the chart below:
   

   Attribute	Attribute type	Value
   Username userName	Personal	Configured in Sign On settings
   Given name givenName	Personal	user.firstName
   Family name familyName	Personal	user.lastName
   Primary email email	Personal	user.email
   Title title	Personal	user.title
   Employee number employeeNumber	Personal	user.employeeNumber
   Location location	Personal	String.join(", ", user.city, user.state, user.countryCode)
   Start date startDate	Personal	user.startDate
   Hire date hireDate	Personal	user.hireDate
   Termination date terminationDate	Personal	user.terminationDate
   Manager ID managerId	Personal	user.managerId

   ✏️

   Note

   Syncing managers: Some organizations have a main system that feeds employee data into Okta. If you're one of them, make sure when you sync manager details, the information from your main system (or "primary source") is in a format that 15Five understands (e.g. email address or Okta employee ID). If it's not a format we recognize, the manager's info will show up as empty in 15Five.

3. Assign the 15Five application to employees. Taking this action triggers an invite email to be sent and gives assigned employees immediate access to the platform.
   
   💡

   Tip

   If you want to delay provisioning an employee to 15Five before a certain date, check out the "Sync start dates" section of this article. This step must be taken before assigning them to the 15Five app in Okta.

You have the option to sync groups from Okta to 15Five or associate current Okta groups with existing groups in 15Five.

Some things to note before you begin:

• Group ID, name, and members are the only group attributes synced from Okta > 15Five.
• Groups created in 15Five and imported to Okta cannot be deleted or changed in Okta— they must be managed in 15Five.
• Since groups imported from 15Five into Okta are not editable within Okta, we suggest creating groups in Okta first and then pushing those groups to 15Five.

Sync a group from Okta to 15Five

1. Create the group in Okta.
2. Click the Push Groups button in Okta.
3. Once the group syncs to 15Five, go to the "Manage groups" page in 15Five (Settings > People > Manage groups). The group will appear in the "Groups" group type.
4. If desired, move the group to a new group type. Because the only group attributes that sync from Okta to 15Five are ID, name, and members, future SCIM syncs will not override the group type change.

Associate a 15Five group with a group in Okta

If a group in Okta has the same name as an existing group in 15Five, pushing the group from Okta to 15Five will not create a new group. Instead, the group from Okta will overwrite the membership of the group in 15Five.

1. Create a group with the same name in Okta. For example, if a "Leadership" group exists in 15Five, create a "Leadership" group in Okta.
2. Add members to the group in Okta.
3. Push the group to 15Five.

You can send start, hire, and termination dates from Okta to 15Five.

• Start dates refer to the date that an employee gains access to 15Five. Adding a start date for an employee allows you to delay their email invites and their access to the platform. On the specified date, they will be sent an email notifying them that they can log in. To delay a person's invite, you must add a start date before assigning them to 15Five in Okta. Otherwise, they will immediately receive a welcome email and have access to the platform upon assignment.
• Hire dates refer to the date that an employee began at the company. This attribute can be pulled into engagement surveys to populate system groups that allow you to measure the engagement of people in different hiring cohorts or tenure bands.
• Termination dates refer to the date that an employee was terminated or departed from a company. This attribute can be used in the HR Outcomes Dashboard to help measure regrettable turnover within your organization.

Sync start, hire, or termination dates

1. Navigate to Okta and open the configuration tabs for 15Five.
2. Under the "Provisioning Tab", click on the "Go to Profile Editor" button.
3. Click "Add Attribute" and fill in the following:
   • Display Name: Start Date / Hire Date / Termination Date
   • Variable Name: startDate / hireDate / terminationDate
   • External namespace: urn:ietf:params:scim:schemas:extension:15Five:2.0:User
   • Scope: Check "User personal"
   • Other settings can be left "as is"
4. Click Save.
5. Click "Mappings" and then "Okta User to 15Five".
6. Select the field on your employees that you would like Okta to send as a Start/Hire/Termination date value. If the desired value doesn't already exist on your Okta User, create the custom attribute in Okta.
7. Click "Save Mappings". The attribute will now be sent to 15Five.

Here are examples of what's expected in the various SCIM payloads:

• POST / PUT Payload
  

  ...
  "schemas": [
   "urn:ietf:params:scim:schemas:core::2.0:User",
   ... 
   "urn:ietf:params:scim:schemas:extension:15Five:2.0:User"
  ],
  ...
  "urn:ietf:params:scim:schemas:extension:15Five:2.0:User": {
   "startDate": "12/15/2019"
  }
  ...

• PATCH Payload
  

  { 
    'schemas': ['urn:ietf:params:scim:api:messages:2.0:PatchOp'], 
    'Operations': [ 
      { 
        "op": "Replace", 
        "path": "urn:ietf:params:scim:schemas:extension:15Five:2.0:User",
        "value": "12/15/2019"
      }
    ] 
  }

You can sync custom attributes from Okta to 15Five by adding a new profile attribute within your SCIM app (15Five app) using an external name that is prefixed with custom_ and using the external namespaceurn:ietf:params:scim:schemas:extension:15Five:2.0:User. Once set up, you can then map a value from your IdP profile into the 15Five app profile. Learn how to create a custom attribute in Okta.