SCIM provisioning with Microsoft Entra ID and Okta

Pilot

Company single sign-on, which this page mentions, is currently enabled only for pilot organizations. SCIM works without it.

With SCIM 2.0, your identity provider keeps the members of your organization up to date: it adds the people you assign to Workify360 Focus, changes their name, e-mail address and team, and suspends or removes them when they leave. SCIM provisioning is part of the Premium plan, and only the owner of the organization manages it.

SCIM does not assign roles. People it adds become employees, and SCIM never changes anyone’s role; an owner or admin gives roles in Settings → Users. No setting of the identity provider can make someone an owner or an admin through SCIM.

Create the token

1. Open Settings → Security and the SCIM page.
2. Choose Create SCIM token, give it a name and how many days it is valid (1 to 730, 365 by default). Confirm your sign-in if Focus asks for it.
3. The token, which starts with w360_scim_, is shown once. Copy it into your identity provider.

The SCIM page also shows the base URL:

https://api.focus.workify360.com/scim/v2

An organization can have two active tokens, so you can put a new one in place before you revoke the old one (scim_key_limit_reached). A SCIM token works only for SCIM: it cannot sign in or call the public API, and API keys and dashboard sessions cannot call SCIM.

Microsoft Entra ID

1. In the Microsoft Entra admin center, open Enterprise applications, choose New application and then Create your own application; choose the option for an application that is not in the gallery. If you already use the Workify360 Focus application for single sign-on, use that one.
2. Open Provisioning, set the provisioning mode to Automatic and enter the base URL as Tenant URL and the token as Secret Token. Choose Test Connection and save.
3. Under Mappings, keep the user mapping and check the attributes in the table below. Turn on the group mapping if your teams should follow Entra groups.
4. Assign the users and groups that should be in Focus, and turn provisioning on.

Entra sends its changes in provisioning cycles, every 20 to 40 minutes; Provision on demand sends one person right away.

Okta

1. In the Okta Admin Console, open your Workify360 Focus app integration (or create one) and turn on SCIM provisioning in its general settings.
2. On the Provisioning tab, under Integration, enter the base URL as the SCIM connector base URL, userName as the unique identifier field, and choose HTTP Header authentication with the token as the bearer token. Allow pushing new users, profile updates and groups, then test and save.
3. Under To App, turn on creating users, updating user attributes and deactivating users.
4. Assign people and push the groups that should become teams.

Okta usually sends a change within a few minutes.

Attribute mapping

SCIM attribute	In Focus	Notes
userName	The member’s SCIM user name	Required; unique among the active members of the organization
emails[type eq "work"].value	Work e-mail; the sign-in e-mail of a new person	The e-mail of an existing account changes only when your organization manages that account
name.givenName, name.familyName, displayName	Name	Only for people SCIM created or accounts your organization manages
externalId	External identifier
active	false suspends the member, true reactivates them
Groups	Teams; a member of a group gets it as their team	With several groups, the last change wins

Enterprise user attributes (department, manager and the like) are accepted and ignored.

People who are already members

Before it creates someone, the identity provider looks for them by userName. Focus answers with the member whose work or sign-in e-mail is that address, so people who were invited before you set up SCIM are taken over instead of added twice. Their role and data stay as they are.

Suspend and remove

• active set to false suspends the member and signs them out at once everywhere: dashboard sessions, the desktop app and their API keys stop with the next request.
• Removing the person in the identity provider (a DELETE) ends the membership. Their data stays, following your retention rules.
• An organization whose account is read-only cannot get new members through SCIM (subscription_read_only).

How fast access ends

Setup	How long a person turned off at the identity provider can still get in
Single sign-on without SCIM	Until the next check with the identity provider: up to 12 hours in the dashboard and 24 hours in the desktop app by default (single sign-on)
SCIM	Until the identity provider sends the change (Microsoft Entra ID: its next provisioning cycle, within 40 minutes; Okta: usually a few minutes), then immediately everywhere
Suspending the member in Focus	Immediately, everywhere

Error messages

Code	What to do
scim_key_limit_reached	Your organization has two active SCIM tokens; revoke the one you no longer use
scim_key_not_found	The token was revoked already; reload the page
subscription_read_only	The account is read-only; see read-only account and plan limits