Configure SCIM with Okta

Optimizing workplace efficiency begins with streamlined systems. 15Five's SCIM-based integration with Okta offers businesses a cutting-edge solution for identity management. By bridging the gap between these two platforms, companies can effortlessly onboard new employees and maintain accurate, real-time data— eradicating the potential for manual errors and saving countless administrative hours.

What you'll find in this article:

• Integration overview
• How to set up SCIM with Okta
• How to sync data from Okta > 15Five (including user data, groups, and custom attributes)
• How to disconnect the integration
• Troubleshooting and FAQs

Integration Overview

Functionalities

The 15Five <> Okta SCIM integration allows you to...

• Create new users: Creating a new user in Okta and assigning them to the 15Five application will create a new user in 15Five.
• Sync profile updates: Updates to a user's data in Okta will be pushed to 15Five.
• Deactivate users: Deactivating the user or disabling the user's access to 15Five within Okta will deactivate the user in 15Five.
• Import new users to Okta: Users created in 15Five can be pulled into Okta and turned into new AppUser objects for matching against existing Okta users.
• Sync groups and group membership: Groups created in Okta can be pushed to 15Five.
• Pull groups into Okta: Groups created in 15Five can be pulled into Okta for reference.
• Delete groups: Groups deleted or removed from the 15Five application in Okta will be deleted in 15Five.

Attributes

You can sync the following attributes from Okta to 15Five:

• First name
• Last name
• Email
• Title
• Employee number
• Location
• Manager ID
• Start date
• Hire date
• Termination date
• Custom attributes
• Group ID
• Group name
• Group members

For more information on how to sync these fields, please refer to the "Sync data from Okta > 15Five" section of this article.

Set up SCIM with Okta

Sync data from Okta > 15Five

Provision users

1. In Okta, navigate to the Provisioning tab > To App subtab and make sure the following settings are enabled:
   • Create Users Update
   • User Attributes Deactivate
   • Users Sync Password (optional): Read through the section entitled Syncing Passwords in this guide to decide if you would like to have Okta sync passwords with 15Five.
2. Map your attributes to the corresponding fields in 15Five using the chart below:
   

   Attribute	Attribute type	Value
   Username userName	Personal	Configured in Sign On settings
   Given name givenName	Personal	user.firstName
   Family name familyName	Personal	user.lastName
   Primary email email	Personal	user.email
   Title title	Personal	user.title
   Employee number employeeNumber	Personal	user.employeeNumber
   Location location	Personal	String.join(", ", user.city, user.state, user.countryCode)
   Start date startDate	Personal	user.startDate
   Hire date hireDate	Personal	user.hireDate
   Termination date terminationDate	Personal	user.terminationDate
   Manager ID managerId	Personal	user.managerId

   ✏️

   Note

   Syncing managers: Some organizations have a main system that feeds employee data into Okta. If you're one of them, make sure when you sync manager details, the information from your main system (or "primary source") is in a format that 15Five understands (e.g. email address or Okta employee ID). If it's not a format we recognize, the manager's info will show up as empty in 15Five.

3. Assign the 15Five application to employees. Taking this action triggers an invite email to be sent and gives assigned employees immediate access to the platform.
   
   💡

   Tip

   If you want to delay provisioning an employee to 15Five before a certain date, check out the "Sync start dates" section of this article. This step must be taken before assigning them to the 15Five app in Okta.

Sync groups

You have the option to sync groups from Okta to 15Five or associate current Okta groups with existing groups in 15Five.

Some things to note before you begin:

• Group ID, name, and members are the only group attributes synced from Okta > 15Five.
• Groups created in 15Five and imported to Okta cannot be deleted or changed in Okta— they must be managed in 15Five.
• Since groups imported from 15Five into Okta are not editable within Okta, we suggest creating groups in Okta first and then pushing those groups to 15Five.

Sync start, hire, or termination dates

You can send start, hire, and termination dates from Okta to 15Five.

• Start dates refer to the date that an employee gains access to 15Five. Adding a start date for an employee allows you to delay their email invites and their access to the platform. On the specified date, they will be sent an email notifying them that they can log in. To delay a person's invite, you must add a start date before assigning them to 15Five in Okta. Otherwise, they will immediately receive a welcome email and have access to the platform upon assignment.
• Hire dates refer to the date that an employee began at the company. This attribute can be pulled into engagement surveys to populate system groups that allow you to measure the engagement of people in different hiring cohorts or tenure bands.
• Termination dates refer to the date that an employee was terminated or departed from a company. This attribute can be used in the HR Outcomes Dashboard to help measure regrettable turnover within your organization.

Sync start, hire, or termination dates

1. Navigate to Okta and open the configuration tabs for 15Five.
2. Under the "Provisioning Tab", click on the "Go to Profile Editor" button.
3. Click "Add Attribute" and fill in the following:
   • Display Name: Start Date / Hire Date / Termination Date
   • Variable Name: startDate / hireDate / terminationDate
   • External namespace: urn:ietf:params:scim:schemas:extension:15Five:2.0:User
   • Scope: Check "User personal"
   • Other settings can be left "as is"
4. Click Save.
5. Click "Mappings" and then "Okta User to 15Five".
6. Select the field on your employees that you would like Okta to send as a Start/Hire/Termination date value. If the desired value doesn't already exist on your Okta User, create the custom attribute in Okta.
7. Click "Save Mappings". The attribute will now be sent to 15Five.

...
"schemas": [
 "urn:ietf:params:scim:schemas:core::2.0:User",
 ... 
 "urn:ietf:params:scim:schemas:extension:15Five:2.0:User"
],
...
"urn:ietf:params:scim:schemas:extension:15Five:2.0:User": {
 "startDate": "12/15/2019"
}
...

{ 
  'schemas': ['urn:ietf:params:scim:api:messages:2.0:PatchOp'], 
  'Operations': [ 
    { 
      "op": "Replace", 
      "path": "urn:ietf:params:scim:schemas:extension:15Five:2.0:User",
      "value": "12/15/2019"
    }
  ] 
}

Sync custom attributes

You can sync custom attributes from Okta to 15Five by adding a new profile attribute within your SCIM app (15Five app) using an external name that is prefixed with custom_ and using the external namespaceurn:ietf:params:scim:schemas:extension:15Five:2.0:User. Once set up, you can then map a value from your IdP profile into the 15Five app profile. Learn how to create a custom attribute in Okta.

Disconnect the integration

1. Go to the SCIM settings page.
2. Uncheck the box to the left of "Enabled."
   
3. Scroll to the bottom of the page and click Save.
   
4. Once SCIM is deactivated, employee accounts will remain active but will no longer be automatically updated by Okta.

Troubleshooting and FAQs