Admin Guide / Integrations / Enterprise Integrations / Single Sign-On & SCIM
SCIM Provisioning
Provision users and synchronize groups from Okta or Microsoft Entra ID.
Rox supports inbound SCIM 2.0. Your identity provider sends changes to Rox. Rox does not push changes back.
SCIM requires SSO. Contact your Rox account team or support to enable SCIM and the combined setup wizard.
Available on Enterprise workspaces. Complete SSO first.
We recommend setting up SSO and SCIM in one wizard. The combined flow is not generally available.
Contact your Rox account team or support to enable SCIM and the combined wizard.
What SCIM syncs
Data | Behavior |
|---|---|
Email (also username) | Set at provisioning |
Name | Managed in the IdP. Cannot be edited in Rox after provisioning. |
Groups and memberships | Synced |
User lifecycle | Create, update, deactivate |
Roles | Not synced. Managed in Rox. |
Only names sync for user profile updates. Later email changes do not sync.
Use the same email for SAML NameID and SCIM
userName. Different identifiers create duplicate users.
Entra: UPN = email (
user.userprincipalname=user.mail).Okta: Application username = Email on both the SSO and SCIM apps.
Step 1: Open Provisioning in the wizard
Check for the green checkmark beside Single Sign-On in the wizard. Open Provisioning. Keep the wizard open and configure your IdP in another tab.
Step 2: Prepare your identity provider
Okta Workspace
Do not assign users or push groups until the Rox connection is enabled.
Use two Okta applications. The SAML Rox app controls sign-in. Rox SCIM controls provisioning. Assign the same users and groups to both after enabling the connection.
1. Add the SCIM template application from the catalog
Open Applications → Applications → Browse App Catalog in Okta. Search for (OAuth Bearer Token) Governance with SCIM 2.0. Select that integration.
Click Add Integration on the integration page.
2. Name the app and finish adding it
Set Application label to Rox SCIM. Check Do not display application icon to users. Under Browser plugin auto-submit, leave Automatically log in when user lands on login page unchecked. Click Next.
Open Sign-On Options → Credentials Details. Set Application username format to Email. Keep Update application username on set to Create and update. Click Done. This app is for SCIM, not a second SSO connection.
Set the SAML Rox application username to Email too.
Microsoft Entra ID
Do not turn on provisioning until the Rox connection is enabled.
Use the enterprise application already configured for Rox SSO. Do not create another app. Open Provisioning → Get started. Select Connect your application in the interface shown.
Check that every user's UPN (user.userprincipalname) equals their email (user.mail) before provisioning.
Choose Automatic for Provisioning Mode.
Step 3: Configure provisioning
Copy the SCIM endpoint from Base URL or Provisioning Endpoint URL in the Rox wizard. Generate the bearer token below.
Keep the bearer token secret. It authorizes user creation and deactivation in your Rox workspace.
Under Bearer Token, click Generate Token. Click Copy And Close to copy it. The token is not shown again after the dialog closes.
Okta Workspace
1. Configure the API integration
Open Rox SCIM → Provisioning → Integration. Click Configure API Integration. Check Enable API integration. Paste the Rox endpoint into Base URL. Remove any trailing forward slash.
Paste the token into OAuth Bearer Token. Keep Import Groups checked. Click Test API Credentials. After the test succeeds, click Save.
2. Choose what Okta sends
Open Provisioning → To App. Click Edit.
Check Create Users, Update User Attributes, and Deactivate Users only. Keep Sync User Password unchecked.
Click Save.
3. Clean up the attribute mappings
Open SCIM Mapping in the Rox wizard. In Okta, open Provisioning → To App → Rox SCIM Attribute Mappings. Click X beside each mapping listed below. Confirm each Remove Mapping dialog with OK:
Primary email type (
emailType)Primary phone type (
primaryPhoneType)Address type (
addressType)
Remove only the type mappings. Keep Email, Primary phone, and Street address. Type mappings can cause user update errors in PUT requests.
Check the remaining mappings:
Email (
email):user.email.Username (
userName): configured in Sign On settings.Display name (
displayName):user.displayName.
Keep one mapping for each attribute. In the wizard, continue through Sync Groups without assigning or pushing groups yet. Finish the wizard next.
Microsoft Entra ID
Open Admin credentials. Select Bearer authentication. Enter:
Tenant URL: The Rox endpoint with
?aadOptscim062020appended.Secret token: The bearer token from the Rox wizard.
Click Test connection. After it succeeds, click Create to save.
Step 4: Finish the wizard and enable the connection
Finish the provisioning wizard. Click Done. Enable the connection before provisioning any users or groups.
On Configure Your Connection, check for green checkmarks beside Single Sign-On and Provisioning. Click Enable Connection at the top right. Wait for completion. Close the wizard.
Use Enable Connection at the top right. The bottom-right button does not enable the connection.
Step 5: Assign users and sync groups
Before you assign a user, confirm their NameID equals their email.
Okta Workspace
Open Rox SCIM → Assignments → Assign. Choose Assign to People or Assign to Groups. Use the same assignments as the SAML Rox app. The SSO app grants sign-in access. The SCIM app creates users before their first sign-in.
Complete the user or group assignments. Click Done.
Okta provisions users from those assignments. To import immediately and review the results, open Import → Import Now. Wait for completion.
Check Settings → Members in Rox after a few minutes. A matching email links the existing Rox account instead of creating another.
Push groups
Assignment provisions a group's users, not the Rox group itself. Open Rox SCIM → Push Groups → Push Groups → Find groups by name. Find each assigned group. Keep Push group memberships immediately checked. Click Save. Wait for Active status. For later refreshes, use Refresh App Groups and the group's push controls.
Pushed groups appear in Settings → User groups. Their members must already exist in Rox. If a Rox group has the same name, the pushed group name includes its Okta group ID.
Open the synced group in Settings → User groups to assign its Rox roles.
Microsoft Entra ID
After enabling the Rox connection, open Users and groups in the enterprise application. Click Add user/group. Select the users or groups and complete the assignment. Keep any assignments made during SSO setup on this same app.
Start provisioning once
After completing the wizard and enabling the Rox connection, open Provisioning in Entra. Set Provisioning Status to On. Click Save once. Do not toggle provisioning for later user or group changes.
Open Overview. Click Start provisioning once. The first cycle creates the assigned users and groups in Rox.
Wait for Initial sync completed under Current cycle status. Review the counts. The example shows two users and one group.
Verify provisioning
Open Settings → Workspace → Single sign-on in Rox. Confirm Connected for the IdP and On for SCIM provisioning. Review the user and group counts. Check the records in Settings → Members and Settings → User groups.
Map groups to roles
New users get Member plus the roles their groups grant. Existing users retain their Rox roles.
Open Settings → User groups in Rox. Select a synced IdP group.
Under Roles this group grants, select the Rox roles. Each member receives those roles at their next sign-in. Manage roles in Rox, not the IdP.
Create and rename IdP groups in the IdP. Add and remove their members there too. These actions are not available in Rox.
Open Settings → Members and select a person. Under Assigned roles, direct roles have an Assigned label. Group roles show the granting group's name. User groups lists the roles each group grants. Effective roles combine all direct and group roles.
Removing a direct role does not remove a role still granted by a group. Edit group-granted roles on the group in Rox. Edit group membership in the IdP. Do not edit group-derived roles on the user.
Manage users and groups
Manage provisioned users in your IdP, not Rox. Rox protects the last Admin from deactivation. Assign another Admin before removing that user.
Okta Workspace
Add or re-provision a user
Assign the user to the SAML Rox app in Okta. Open Rox SCIM → Assignments → Assign → Assign to People. Click Assign beside the user. Review their details. Click Save and Go Back, then Done. Use these steps to provision a previously unassigned user again.
The SSO assignment restores sign-in. The SCIM assignment restores provisioning. Check the account in Settings → Members.
Unassign and deprovision a user
Remove the SAML Rox app assignment to revoke sign-in. Open Rox SCIM → Assignments. Click X beside the user. Confirm Unassign User with OK. If access comes from a group, remove the user from that group instead of removing an individual assignment.
The deactivated user disappears from Settings → Members. If the change has not appeared, open Rox SCIM → Import → Import Now. Check again.
Change a name for Rox only
Open Rox SCIM → Assignments. Click the pencil beside the user. Edit Display name. Scroll down and save. This changes the app name without changing the global Okta profile. Check the new name in Settings → Members.
Use a name from the global Okta profile
Open the user in Directory → People. Select Profile → Edit. Change the name and save.
An app override can retain the old name. Edit the user's assignment in Rox SCIM → Assignments. Click Reset beside each overridden name field, including Display name. Save to restore global profile values. Check the new name in Rox.
Add and provision a group
Open Directory → Groups → Add group. Enter a name. Click Save. Add the members. Assign the group to both Rox and Rox SCIM from each app's Assignments tab.
SCIM assignment creates the users in Settings → Members. It does not create the Rox group. Open Rox SCIM → Push Groups → Find groups by name. Select the group. Keep Push group memberships immediately checked. Click Save. After the push is Active, check Settings → User groups.
Change group membership
Open the group in Directory → Groups. Use the member controls to add people. Under Assign people, click + beside each person. Click Done. Keep the group assigned to both apps and pushed from Rox SCIM. Check users in Settings → Members and group membership in Settings → User groups.
Remove members in Okta too. Rox retains removed members until every member of the pushed group exists in Rox. Assign everyone in that group to Rox SCIM.
Remove a pushed group and its access
Open the push-status menu under Rox SCIM → Push Groups. Select Unlink pushed group. Choose Delete the group in the target app (recommended). Click Unlink. The Rox group disappears from Settings → User groups. Its user accounts remain provisioned.
To remove provisioning access, open Rox SCIM → Assignments → Groups. Click X beside the group and confirm. Check Settings → Members for deprovisioned users. Remove the group's SAML Rox assignment to revoke sign-in too. Unlinking a pushed group does not remove either app assignment.
Microsoft Entra ID
Add and provision a user
Open Users and groups → Add user/group in the Entra app used for SSO. Assign the user. Entra processes assignments in provisioning cycles. Wait for a cycle or provision on demand.
For immediate provisioning, open Provisioning → Provision on demand. Find and select the user. Click Provision. Wait for success.
Refresh Settings → Members in Rox. Check that the user appears.
Unassign and deprovision a user
In the enterprise app, open Users and groups. Select the user. Click Remove assignment. Wait for a provisioning cycle. Refresh Settings → Members in Rox. The user no longer appears.
Add and provision a group
In the same app, open Users and groups → Add user/group. Assign the group. To provision immediately, open Provisioning → Provision on demand. Find and select the group. Select up to five members at a time. Click Provision.
Refresh Settings → User groups in Rox. Assign roles to the provisioned group in Rox. Entra does not supply Rox roles.
Unassign and deprovision a group
In the enterprise app, open Users and groups. Select the group. Click Remove assignment. Check that the group disappears from Settings → User groups in Rox.
