# Okta SCIM
source: https://docs.chalk.ai/docs/okta-scim

## Setting up Okta to automatically provision and deprovision Chalk users.

Chalk implements SCIM in order to allow external
identity providers (IDPs) to automatically provision and
deprovision users as they are added and removed from
the external identity provider.

### Supported Features

- IDP-initiated user provisioning
- IDP-initiated user deprovisioning
- IDP-managed group assignment

### Requirements

- Configure Chalk to use Okta SAML
for authentication
- Configure the Okta Chalk SAML app to use SCIM for
provisioning.

### Configure Okta SCIM

- Generate an SCIM authentication token in your Chalk
settings dashboard. This token is extremely sensitive
and care should be taken to ensure that it is not leaked.
You'll use this token to configure Okta's SCIM authentication.
- Navigate to your Okta admin dashboard.
- Edit your Chalk SAML app.
- Configure SCIM using:SCIM Connector base URL: https://api.chalk.ai/scim/v2Important: This URL will change if your metadata plane
is self-hosted. Confirm your team's SCIM connector base URL in the Settings > Single Sign-On.Unique identifier field for users: emailSupported provisioning actions:Push New UsersPush Profile UpdatesPush GroupsSupport provisioning to app:Create UsersUpdate User AttributesDeactivate UsersAuthentication Mode: "HTTP Header", and set the Bearer header to the SCIM token you generated in your Chalk dashboard.
- Contact Chalk Support to enable SCIM on
your account, and set up the initial Okta Group to Chalk
Role mapping.

App Integration Configuration