Skip to main content

Set up user provisioning (SCIM) with Okta or Entra ID

Let Okta or Microsoft Entra ID create, update and switch off your people in Fugo automatically, with the right role and Space.

Written by Fugo

With user provisioning, your identity provider manages Fugo accounts for you. When you assign someone to Fugo in Okta or Microsoft Entra ID, they get a Fugo account in the right Space with the right role before they ever sign in. Change their role or Space in your identity provider and Fugo follows. When you switch someone off or remove them, their access to Fugo stops.

Fugo does this with SCIM, the standard identity providers use to keep accounts in sync across apps.

Table of contents

Before you start

You'll need:

  • The Enterprise plan. SCIM lives on the Single sign-on tab, which is part of Enterprise.

  • Tenant Admin access in Fugo. Only Tenant Admins can see the SCIM settings or create a token.

  • SSO already set up, with your email domains listed in it. If you haven't done that yet, start with SSO Overview.

  • Admin access to your identity provider, to the same app you use for Fugo SSO.

Only addresses in your SSO domains can be provisioned. If your SSO settings list yourcompany.com, Fugo will accept jane@yourcompany.com and refuse jane@gmail.com. That stops anyone from creating an account for an address that signs in somewhere else.

Step 1: Generate your SCIM token in Fugo

  1. Open your account menu and click Settings.

  2. In the Team section, open the Single sign-on tab.

  3. Scroll down to User provisioning (SCIM).

  4. Copy the SCIM base URL. For most accounts it's https://api.fugo.ai/scim/v2.

  5. Click Generate token.

  6. Copy the token and keep it somewhere safe until you've pasted it into your identity provider. It starts with fgs_.

  7. Click I've copied it.

Fugo only shows the token once. If you close the dialog before copying it, rotate the token to get a new one (see Managing your SCIM token).

Once your identity provider starts using the token, the section shows when it was last used, so you can see at a glance that provisioning is running.

Step 2: Connect Microsoft Entra ID

Do this in the same Enterprise application you set up for Fugo SSO.

Turn on provisioning

  1. In the Microsoft Entra admin center, go to Identity > Applications > Enterprise applications and open your Fugo app.

  2. Open Provisioning and click New configuration.

  3. Under Admin credentials, fill in:

    • Select authentication method: Bearer authentication

    • Tenant URL: your SCIM base URL from Fugo, exactly as shown. Don't add /Users or a trailing slash.

    • Secret token: your SCIM token from Fugo

  4. Click Test connection. Create stays greyed out until the test succeeds.

  5. Click Create.

If your tenant still shows the older layout, set Provisioning Mode to Automatic, fill in the same two fields under Admin Credentials, click Test Connection, then Save.

Check the mappings

  1. Still in Provisioning, open Mappings.

  2. Open Provision Microsoft Entra ID Groups and set Enabled to No. Fugo doesn't support group provisioning (see Good to know).

  3. Open Provision Microsoft Entra ID Users. The default mappings work. Check these four:

    • userName: userPrincipalName

    • active: Switch([IsSoftDeleted], , "False", "True", "True", "False")

    • emails[type eq "work"].value: mail

    • name.givenName and name.familyName: givenName and surname

    Fugo uses the work email as the person's sign-in address. If some of your users have no mail attribute in Entra, map userName to an address in your SSO domain instead.

You can leave Entra's other default attributes (job title, phone numbers, address and so on) as they are. Fugo ignores what it doesn't use.

To set each person's role and Space from Entra, add the Fugo attributes now (see Choosing a role and Space for each person below).

Choose who gets provisioned and start

  1. Under Settings, set Scope to Sync only assigned users and groups.

  2. Assign the people (or groups of people) who should have Fugo accounts under Users and groups in the app, as you did for SSO.

  3. Set Provisioning Status to On and click Save.

Entra runs its first sync within about 40 minutes and then keeps things in sync on a regular cycle. To check one person straight away, open Provision on demand, pick them and click Provision. All four steps should come back as Success.

If someone already had a Fugo account with the same email, step 4 says they were updated rather than created. That's expected: Fugo links the existing account instead of making a second one.

Step 3: Connect Okta

Do this in the same app integration you set up for Fugo SSO.

Turn on provisioning

  1. In the Okta Admin Console, go to Applications > Applications and open your Fugo app.

  2. On the General tab, click Edit under App Settings, set Provisioning to SCIM, and click Save.

  3. Open the new Provisioning tab and click Edit under SCIM Connection.

  4. Fill in:

    • SCIM connector base URL: your SCIM base URL from Fugo

    • Unique identifier field for users: userName

    • Supported provisioning actions: tick Push New Users and Push Profile Updates. Leave Push Groups and Import Groups unticked.

    • Authentication Mode: HTTP Header

    • Authorization: your SCIM token from Fugo

  5. Click Test Connector Configuration. Create Users and Update User Attributes should show as found.

  6. Click Save.

Turn on the provisioning actions

  1. On the Provisioning tab, open To App and click Edit.

  2. Enable Create Users, Update User Attributes and Deactivate Users.

  3. Click Save.

Make sure the app's Application username format (on the Sign On tab) is set to Email, so Fugo receives each person's work email.

Assign people

Assign people (or groups of people) to the app on the Assignments tab, as you did for SSO. Okta creates them in Fugo straight away.

To set each person's role and Space from Okta, add the Fugo attributes (see the next section).

Choosing a role and Space for each person

Fugo reads two optional attributes, role and space. If you skip them, everyone lands with the least access that makes sense (see the table below), and you can change roles in Fugo later.

Attribute

What to send

role

One of TenantAdmin or TenantMember (admin or member of the whole workspace), or TeamAdmin or TeamMember (admin or member of one Space).

space

The name of a Space, exactly as it appears in Fugo. Upper and lower case don't matter.

How Fugo combines them:

You send

The person ends up

TenantAdmin or TenantMember, no Space

At workspace level with that role

A Space, with TeamAdmin, TeamMember or no role

In that Space with that role, or as a Space Member if no role is sent

TeamAdmin or TeamMember, no Space

In your workspace's default Space with that role

Nothing

In your default Space as a Space Member, or at workspace level as a Tenant Member if you have no default Space

Sending a workspace role (TenantAdmin or TenantMember) together with a Space doesn't work, because workspace roles aren't tied to a Space. Your identity provider will show an error for that person.

Missing attributes never make anyone an admin. On later updates, an attribute your identity provider doesn't send leaves that setting as it is.

Adding the attributes in Entra ID

  1. In Provisioning > Mappings > Provision Microsoft Entra ID Users, tick Show advanced options and click Edit attribute list for customappsso.

  2. Add two attributes, both of type String:

    • urn:fugo:params:scim:schemas:extension:2.0:User:role

    • urn:fugo:params:scim:schemas:extension:2.0:User:space

  3. Save, then go back to the mappings and click Add New Mapping for each one. Choose where the value comes from, for example a user attribute like department or extensionAttribute1, or an expression.

Adding the attributes in Okta

  1. Go to Directory > Profile Editor and open your Fugo app's user profile.

  2. Click Add Attribute and create two attributes, both with Data type set to string:

    • Display name Fugo role, Variable name fugoRole, External name role

    • Display name Fugo space, Variable name fugoSpace, External name space

    For both, set External namespace to urn:fugo:params:scim:schemas:extension:2.0:User.

  3. Click Mappings and map each one from the Okta user profile, or set them per person on the app's Assignments tab.

If you already send fugo_role and fugo_space claims for SSO, use the same source values here.

What happens when someone leaves

When you unassign someone from the Fugo app, or deactivate them in your identity provider, Fugo switches their account off:

  • They can't sign in.

  • Their open sessions are signed out. Anything they're already signed in to stops working within about five minutes.

  • API keys they created stop working.

Switching them back on in your identity provider restores their access.

Heads up about API keys. If someone set up an integration (for example a Zapier connection) using their own API key, that integration stops when they leave. A Tenant Admin can create a new key for it.

Entra ID also deletes the person's Fugo account 30 days after they're deleted in Entra. Okta never deletes accounts, only switches them off.

Managing your SCIM token

There's one SCIM token per workspace. In the User provisioning (SCIM) section:

  • Rotate token creates a new token. The old one stops working immediately, so paste the new one into your identity provider straight away.

  • Revoke token deletes it. Provisioning stops until you generate a new one.

If you remove your SSO configuration, an existing token keeps working until you revoke it. The section reminds you of this.

Good to know

People already in Fugo are matched, not duplicated. If someone already has a Fugo account with the same email, your identity provider links to that account rather than creating a second one.

Their first SSO sign-in lands on the provisioned account. Nobody gets a second account when they sign in for the first time.

Groups aren't supported. Your identity provider can't push groups to Fugo, so set role and Space per person with the attributes above. You can still use groups in your identity provider to decide who gets assigned to Fugo.

Be careful with your last Tenant Admin. Fugo will switch off a workspace's last Tenant Admin if your identity provider asks it to. If that happens by mistake, nobody is left to fix the settings, so contact support@fugo.ai and we'll switch an admin back on.

Google Workspace can't provision users to Fugo. Google only provisions users into apps from its own catalog. Your team can still sign in with Google SSO, and accounts are created the first time each person signs in.

Troubleshooting

What you see

What to check

Test Connection fails with an authorization error

The token was copied incompletely, or it has been rotated or revoked. Generate or rotate a token in Fugo and paste it again.

Some people aren't created, and the error mentions their email

Their email isn't in one of the domains listed in your SSO settings. Add the domain to SSO, or change the address in your identity provider.

The error says a Space wasn't found

The space value doesn't match a Space name in Fugo, or two Spaces share that name. Check the spelling, or rename one of the Spaces.

The error says the role doesn't fit

A workspace role (TenantAdmin or TenantMember) was sent together with a Space. Send a Space role instead, or no Space.

A role or Space change is refused

The change would leave your workspace without an active Tenant Admin. Make someone else a Tenant Admin first.

Every request fails

Your workspace may be suspended. Check Billing in Settings.

Entra shows the job as quarantined

Entra pauses provisioning when many requests fail in a row. Fix the cause from the provisioning logs, then click Restart provisioning.

Still stuck? Reach out through the support chat in the Fugo CMS, or email support@fugo.ai.

Related Articles
Did this answer your question?