6 min read
Feature
System for Cross-domain Identity Management (a.k.a. SCIM) is a protocol for user management across multiple applications. It allows an IT or Operations team to easily provision (add), deprovision (deactivate), and update user data across multiple applications at once.
To set up SCIM provisioning in Okta you will need to have the involvement of both the monday.com admin and the manager of your Okta account.
SCIM capabilities supported in monday.com
- Provisioning of Users
- Deprovisioning of Users
- Provisioning of Teams
- Deprovisioning of Teams
- Team Renaming
- Updating User Details
- Assigning Users to Teams
- Unassigning Users from Teams
- Changing User’s Password
Configuration
- Step 1 - Add monday.com to Okta
Go to your Okta admin page and switch to the "Classic UI" by clicking on the developer console:
Then click on applications, click add app, and search for monday.com in the app store:
- Step 2 - Go to Provisioning
Go to the Okta Admin page and select the monday.com application from the list. Then select the tab “Provisioning”
Then click on the settings tab “Integration” and then "Configure API Integration":
- Step 3 - Go to the monday.com admin section to retrieve the provisioning token
To do this, open up your monday.com account and click on your profile picture in the bottom left corner and then select "Admin". From the admin section of your account, click on "Security" and the left side and then into the SCIM section.
Here you can generate a token and then copy and paste it into Okta.
- Step 4 - Enable Provisioning
Paste the API Token into Okta and test the API Credentials:
Once you receive verification that the credentials are valid, click save
- Step 5 - Complete your setup
Click on the "To App" tab in the settings and enable all of the abilities you will need to work with monday.com.
Set up user provisioning
Go to the assignments tab under your monday.com app and then click on assign and choose to assign people or groups to the monday.com app.
User attributes
These fields are supported for mapping user attributes:
- Name (can’t contain special characters)
- Email (must be lowercase)
- userType (admin, member, viewer, guest, custom roles)
- Title (user’s position listed in Profile Section)
- Active (whether or not a user is enabled or disabled)
- Timezone
- Locale (Language)
- Phone number
- Address
Do note, when using Okta for both SCIM provisioning and SSO login:
- When a user is created via SCIM provisioning, their email can be mapped to any valid email field you choose, but the email used during SSO login is always the 'user.email'
- If you intend to use SSO login in addition to SCIM provisioning, you need to ensure the email used for SCIM provisioning is mapped to 'user.email' or to a field that holds an equivalent value
Set up user type attribute
You can provision the monday.com user type by creating a custom attribute in Okta.
The optional user types are:
- admin
- member
- viewer
- guest
- or custom role id
To set up SCIM provisioning to support custom roles as user types:
- Configure the relevant custom role on monday.com as described in this article.
- Copy the custom role ID. This can be done from the account permissions center, by clicking on the three-dot menu right next to the role name and then "Copy ID", as shown below.
Steps:
- Click the Directory tab, then select Profile Editor
- Click the Add Attribute button
- Fill out the fields and click Save (at the bottom):
Set up team provisioning
What does it mean to push a group into monday.com? When you push a group into monday.com you will create a new team in your account with all the users that are assigned to that group in Okta.
For privacy measures, we recommend coordinating the team provisioning with the monday.com admin, in order to avoid users losing access to their data or users gaining access non-intendedly.
Before pushing a group into monday.com, first, make sure to assign the group to the monday.com account. It is important to assign the group before you push the group because the group cannot be pushed unless all the users in the group are already in the monday.com account.
Steps:
1. Assign the group to your monday.com account
2. Click on the Push Groups tab and click the button “Push Groups”
3. Select the group you would like to push into monday.com and click "Save"
Error Handling
Please find the below table that contains error codes and their possible reason. Check out the third column for resolution suggestions:
Set a default owner for automations, integrations, and workflows
Admins can define a fallback policy that automatically transfers ownership of automations, integrations, and workflows from deactivated users, regardless of the reason for deactivation. As a result, no automations, integrations, or workflows will be affected by user offboarding, ensuring that the account's automated flows continue to run smoothly.
To access these settings, open the Administration section of your account as so:
And then the Automations Ownership tab:
With this option, automations, integrations, and workflows will automatically transfer to this default owner when a user is deactivated. This applies when any user is deactivated in your account.
You can choose any active user on your account to be the default owner. Select the user from the dropdown menu and click Save to apply your choice:
In addition, during the user deactivation process, the admin is able to change the default ownership transfer and select a different target owner for the automations of the off-boarded user. This can be done f rom the Users tab by clicking the three dots to the right of the user's name and selecting Deactivate user:
You can then choose a new owner from the dropdown menu. If you've set a default owner, you can override this default when manually deactivating a user within your monday.com account:
FAQs
We've outlined a list of SCIM-related frequently asked questions for you. Click on this link here to check them out!
If you have any questions, please reach out to our team right here. We’re available 24/7 and happy to help.