Configure System for Cross-domain Identity Management (SCIM) for Okta

System for Cross-domain Identity Management (SCIM) automates creating, updating, and removing ALTR administrator accounts directly from your Okta directory. ALTR currently supports SCIM with Okta only.

For what SCIM controls at the platform level and how it relates to SSO, see SSO and SCIM.

Prerequisites

When enabling SCIM, make sure you have:

• SSO already enabled. See Configure Single Sign-On (SSO) for Okta.
• Administrator access to your Okta organization.
• An ALTR Enterprise account.
• Super Administrator access to your ALTR account. See Administrators.

Note

This guide’s Okta screenshots and click-path were last validated in July 2025 and haven’t been re-verified against the current Okta admin console for this rebuild.

Enable Provisioning in Okta for Your ALTR Application

To enable provisioning:

1. Select your existing ALTR application in Okta.
2. Click the General tab.
3. Under App Settings, click Edit.
4. For Provisioning, select SCIM.
5. Click Save.

Configure Okta to Connect to ALTR’s SCIM API

To connect Okta to ALTR’s SCIM API:

1. Log into ALTR and select Settings > Preferences in the navigation menu.
2. Click the SSO/SCIM tab.
3. Select Okta as your IdP.
4. Click Generate. ALTR generates the SCIM base URL and bearer token for your Okta organization.
5. Copy the base URL from ALTR. Keep the ALTR page open until you finish enabling SCIM.
6. Open a new browser tab and log into Okta.
7. Click the Provisioning tab.
8. Select Integration in the navigation menu (selected by default).
9. Under SCIM Connection, click Edit.
10. Paste the base URL from ALTR into the SCIM connector base URL field in Okta.
11. Enter userName in the Unique identifier field for users field.
12. Select the Import New Users and Profile Updates, Push New Users, and Push Profile Updates checkboxes.
13. Select HTTP Header from the Authentication Mode dropdown.
14. Return to ALTR and copy the bearer token from the SSO/SCIM tab.
15. Return to Okta and paste the bearer token into the Bearer field (under HTTP Header). Keep the ALTR page open until you finish enabling SCIM.
16. Click Save. Okta tests the connection to ALTR; if the test succeeds, you can close the modal in ALTR.

Configure Okta to Create, Edit, and Remove ALTR Administrators

To configure provisioning to ALTR:

1. Click the Provisioning tab.
2. Select To App in the navigation menu (selected by default).
3. Under Provisioning to App, click Edit.
4. Select Enable for Create Users, Update User Attributes, and Deactivate Users.
5. Click Save.

Enable the ALTR_ADMIN_LEVEL Attribute in Okta

This attribute lets you assign an ALTR role (Administrator, Super Administrator, or Data Consumer) to each provisioned user. See Administrators for what each role can do.

To enable the attribute:

1. Click the Provisioning tab.
2. Select To App in the navigation menu (selected by default).
3. Under Attribute Mappings, click Go to Profile Editor.
4. Click Add Attribute.
5. Enter ALTR_ADMIN_LEVEL in the Display name, Variable name, External name, and External namespace fields.
6. For Enum, select Define enumerated list of values.
7. Under Attribute Members, enter ADMINISTRATOR for both the Display name and Value fields. These fields are case-sensitive.
8. Click Add Another.
9. Enter SUPERADMINISTRATOR for both the Display name and Value fields.
10. Click Add Another.
11. Enter DATA_CONSUMER for both the Display name and Value fields.
12. For Attribute required, select Yes.
13. For Attribute type, select Group.
14. Click Save.

Provision Users to ALTR

To provision users:

1. Navigate to your ALTR application in Okta.
2. Under the Import tab, import your existing ALTR administrators. Okta matches them to Okta identities by username.
3. Click the Assignments tab.
4. Select Assign > Assign to People.
5. Select the Okta user to assign to ALTR.
6. If you enabled ALTR_ADMIN_LEVEL, set the user’s role to ADMINISTRATOR, SUPERADMINISTRATOR, or DATA_CONSUMER.
7. Click Save.
8. Repeat these steps for each user who needs ALTR access.

Deactivate SCIM

To deactivate SCIM, contact ALTR Support.

Note

When SCIM is deactivated, ALTR keeps the administrator accounts that existed at the time of deactivation. Disabling SCIM also re-enables ALTR’s non-SCIM administrator management, so administrators can once again be created, edited, or deactivated directly in ALTR.