> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gumloop.com/llms.txt
> Use this file to discover all available pages before exploring further.
# SCIM with Okta
> Configure SCIM user provisioning for Gumloop with Okta
SCIM (system for cross-domain identity management) lets Okta communicate with Gumloop on a recurring basis: Okta tells Gumloop which users should have access — and which should not — along with useful user *attributes*. Gumloop uses this to provision, deprovision, and update users automatically (see [SSO, SAML & SCIM](/enterprise-features/sso_saml_scim#scim-provisioning)).
Connecting Okta to Gumloop requires sharing two pieces of information with Okta, both of which come from Gumloop:
1. A **base URL** that Okta will perform operations on (e.g. via HTTP PATCH)
2. A **bearer token** that Okta will include with its requests
## Before you start: get your base URL and bearer token from Gumloop
SCIM is an Enterprise add-on — a Gumloop organization admin requests enablement via [support@gumloop.com](mailto:support@gumloop.com), then generates a setup link at [gumloop.com/settings/organization/sso](https://www.gumloop.com/settings/organization/sso). The setup page shows your SCIM **base URL** and lets you generate the **bearer token**.
Gumloop **does not store bearer tokens** — the token is shown once, at generation time. You can generate a new one at any time, which immediately invalidates the previous token.
# Configuring Okta
Start by navigating to the relevant application in Okta. If you are unsure how to create such an Application, please review the [SAML with Okta](/enterprise-features/idp-guides/saml-with-okta) guide for an in-depth explanation.
Make sure you're on the *General* tab and press *Edit* on the *App Settings* card.
Make sure the Provisioning box shows a checkmark. By default, Okta leaves this box unchecked.
Press *Save* in the lower right corner.
Navigate to the *Provisioning* tab for the Application.
On the *Provisioning* tab, click the *Edit* button toward the top right of the card.
Look for a field marked *SCIM connector base URL*. This is the *base URL* from your Gumloop SCIM setup page. Paste it here.
Next, look for a field marked *Unique identifier field for users*. We need this to say "email" exactly. Gumloop relies on users' emails as a unique identifier.
Look for a series of checkboxes labeled *Supported provisioning actions.* You will see five checkboxes. Set your configuration to match the following:
* [x] Import New Users and Profile Updates
* [x] Push New Users
* [x] Push Profile Updates
* [x] Push Groups
* [ ] Import Groups
**Ensure that *Import Groups* remains unchecked.** The SCIM Connection will fail otherwise.
Now look for a dropdown menu labeled *Authentication Mode*. This must change from its default value to *HTTP Header*.
Now paste the bearer token from Gumloop in the field marked *Authorization*.
Then once more hit *Save* in the lower right.
Now look in the sidebar to the left and find the item marked *To App*. Click this.
You'll see four checkboxes. Set them to match the following:
* [x] Create Users
* [x] Update User Attributes
* [x] Deactivate Users
* [ ] Sync Password
Then press *Save* in the lower right.
Now navigate to the *Assignments* tab.
Using the *Assign* dropdown, choose to assign the relevant People (i.e. users) or Groups. This guide uses People.
You'll now see a list of People. For each that you wish to assign to the Application, press the *Assign* button to the right.
You'll have the opportunity to edit this person's attributes, but it's usually fine just to scroll down and press *Save and Go Back*.
Unless you wish to add other People to the Application, you can now press *Done*.
Okta is now pushing users to Gumloop.
If you assigned users to the Application *before* setting up the SCIM Connection, you may need to instruct Okta to force sync. You can read more [here](https://support.okta.com/help/s/article/How-To-Use-The-Force-Sync-Option?language=en_US).
# Enabling synchronization in Gumloop
Pushed users only reach your organization once synchronization is enabled on the Gumloop side. A Gumloop organization admin returns to [gumloop.com/settings/organization/sso](https://www.gumloop.com/settings/organization/sso), selects the SCIM directory, and enables synchronization — see [Setting Up SCIM](/enterprise-features/sso_saml_scim#setting-up-scim).
Once enabled, configuration is complete: assigned users appear in your organization's member list after the next sync (automatic every 15 minutes, or triggered manually by the admin).