SCIM v2 provisioning lets you synchronize user accounts and groups between TalentLMS and your identity provider (IdP) through the SCIM v2 API. It helps automate user and group management, saving time while centralizing user access. Common uses include creating new users in TalentLMS, activating or deactivating users, automatically updating user profiles, creating groups, and managing group memberships.

Currently, TalentLMS only supports SCIM provisioning through Okta and Azure AD, but we hope to support more providers compatible with the SCIM v2 API in the near future.

How to configure provisioning with Okta

We have broken down our guide into four sections:

A. Features
B. Requirements    
C. Configuration
D. Known issues & troubleshooting

Let’s start!

A. Features

The supported provisioning features are:

• Push New Users: Users created in Okta are automatically added to TalentLMS.
• Push Profile Updates: Updates made to user profiles through Okta are synced to TalentLMS.
• Push User Deactivation/Activation: Deactivating a user or revoking their access to the application through Okta deactivates the user in TalentLMS. User activation is also supported.

• Import New Users: Users created in TalentLMS are automatically added to Okta. If a new TalentLMS user is an existing Okta user, the two accounts are linked. Imported users are assigned to the TalentLMS app in Okta as soon as they are confirmed from the Import tab on the Okta TalentLMS app page.

• Push Password Updates: Updates made to user passwords through Okta are synced to TalentLMS.
• Import Groups: Groups created in TalentLMS are imported into Okta. If a matching group already exists in Okta, the existing group is linked instead of creating a duplicate. 
• Push New Groups (Custom Okta app only): Groups assigned through your custom Okta SSO application can be created in TalentLMS if they don't already exist.
• Push Group Memberships (Custom Okta app only): Users can be added to or removed from TalentLMS groups based on their group memberships in Okta.

B. Requirements

First of all, make sure that you have configured SSO with TalentLMS properly. To do that:

1. Sign in to your TalentLMS account as Administrator and go to the Users tab on the Home > Account & Settings page.

2. Click Single Sign-on (SSO) (1). The required fields must contain the values provided in this article.

3. Click Save and check your configuration (2) to double-check that all the required user attribute/value pairs (e.g., username/TargetedID, user email) are returned from Okta.

4. Before returning to your Okta TalentLMS app page, check Enable SCIM v2 user provisioning (3). If you are configuring a custom Okta SSO application and want to synchronize groups, also check Enable SCIM v2 group provisioning (4). Then, note down the provided SCIM key. Make sure to click Save at the bottom of the page.

C. Configuration

Depending on your provisioning requirements, you can configure SCIM provisioning with Okta using one of the following methods.

Option 1: Default TalentLMS Okta application (User provisioning) 

1. Sign in to your Okta dashboard, go to Applications, and select TalentLMS.

2. Go to the Provisioning tab and, on the Settings panel, click Integration.

3. Click Configure API Integration, then select Enable API Integration.

4. In the API Token field, paste the SCIM key you noted earlier.

5. Click Test API Credentials and, if successful, click Save.

6. On the Settings panel, click To App and then Edit to enable your preferred Okta-to-TalentLMS provisioning features. Repeat the same process for To Okta to configure your TalentLMS-to-Okta provisioning settings.

Option 2: Custom Okta SSO application (User and group provisioning)

If you want to provision both users and groups through SCIM, you must first configure a custom Okta SSO application.

To create a custom Okta SSO application, follow the instructions in this article. Once your custom application has been created:

1. Sign in to your Okta dashboard, go to Applications, and select your custom SSO application.

2. Go to the General tab and click Edit under App Settings.

3. Under Provisioning, select SCIM, then click Save.

4. Go to the Provisioning tab and, on the Integration panel, click Edit.
Configure the following settings:

• SCIM Connector Base URL: Enter your TalentLMS portal SCIM URL in the format: https://yourdomain.talentlms.com/api/scim2
• Unique identifier field for users: Enter the attribute used as the unique identifier (for example, userName).
• Supported provisioning actions: Select the provisioning actions you want to enable.
• Authentication Mode: Leave this set to HTTP Header.
• Authorization: Paste the SCIM key you noted earlier.

5. Click Test Connection to verify your configuration. If the test is successful, click Save.

D. Known issues & troubleshooting

Before you start using your Okta-enabled provisioning service, take a look at these important notes:

• When the “Time zone” and “User type” attributes are not defined for a specific user, then their TalentLMS user account is assigned the default values. The default time zone can be configured from the Locale section on the Home > Account & Settings > Basic settings page. The default user type can be configured from the Home >  Account & Settings > Users page. The default values for each branch can be configured from the branch homepage by the branch admin.
• When you delete a provisioned user account in TalentLMS, you must make sure the account is deleted permanently. That way, when creating a new user through user provisioning, you avoid getting an error message that their email is not unique. For more on deleting user accounts permanently, see this article.
• When you change an assigned user’s username from the Edit user assignment page, the username of the existing TalentLMS account is also updated. However, we strongly recommend that you avoid changing an assigned user’s username from the Edit user assignment page because that process is not fully supported by Okta. Instead, you can change the username from the user’s profile page and wait for your changes to be synced to TalentLMS and all the other apps assigned to that user.
• When trying to push a user to your TalentLMS domain through the SCIM v2 API, you may get the following error message: "A user with the same email address already exists." This could mean two things:
  A. There’s already a TalentLMS user account for the same user registered with that email address, but the username is different from the one pushed by Okta. In that case, the username matching fails due to the email address not being unique, so TalentLMS tries to create a new user account. The issue is resolved by changing the user’s username either in Okta or in TalentLMS to match the other one.
  B. You have recently deleted a TalentLMS user that was registered with that same email address. In that case, the new user’s email is not recognized as unique because the old user isn’t permanently deleted (i.e., TalentLMS doesn’t remove users permanently at first delete so that you can restore a user if they’ve been deleted by accident). The issue is resolved by permanently deleting the user who has the same email. For more on deleting users permanently, see this article.