Skip to main content

Set up user provisioning (SCIM) with Okta or Entra ID

Let Okta or Microsoft Entra ID create, update and switch off your people in Fugo automatically, with the right role and Space.

Written by Fugo

With user provisioning, your identity provider manages Fugo accounts for you. When you assign someone to Fugo in Okta or Microsoft Entra ID, they get a Fugo account in the right Space with the right role before they ever sign in.

Change their role or Space in your identity provider and Fugo follows, as long as you send Fugo's role and space attributes. When you switch someone off or remove them, their access to Fugo stops.

Fugo does this with SCIM, the standard identity providers use to keep accounts in sync across apps.

Table of contents

Before you begin

You'll need:

  • The Enterprise plan. SCIM lives on the Single sign-on tab, which is part of Enterprise.

  • Workspace admin access in Fugo. Only workspace admins can see the Single sign-on tab, view the SCIM settings or create a token.

  • SSO already set up, with your email domains listed in it. The User provisioning (SCIM) section only appears once SSO is set up. If you haven't done that yet, start with SSO Overview.

  • Admin access to your identity provider, to the same app you use for Fugo SSO.

Only addresses in your SSO domains can be provisioned. If your SSO settings list yourcompany.com, Fugo will accept jane@yourcompany.com and refuse jane@gmail.com.

A domain that another workspace has already claimed for its SSO is refused too. That stops anyone from creating an account for an address that signs in somewhere else.

If your SSO settings have no domains yet, the section tells you: Add your company's email domains to the SSO settings first. Okta and Entra can only add people whose email is in one of them.

Step 1: Generate your SCIM token in Fugo

In this step you copy the two things your identity provider needs from Fugo: the SCIM base URL and a SCIM token. Keep both to hand for Step 2 or Step 3.

1. Open Settings.

2. In the Team section, click Single sign-on.

3. Scroll below your SSO summary to User provisioning (SCIM). The section only shows on the summary, not while you're editing your SSO configuration.

4. Next to SCIM base URL, click the copy button. The URL is https://api.fugo.ai/scim/v2 for every workspace. Your token tells Fugo which workspace the requests are for.

The User provisioning (SCIM) section on the Single sign-on tab, showing the SCIM base URL with a copy button and a Generate token button.

5. Click Generate token. There's no confirmation step. The token opens in a Your new SCIM token dialog.

6. Copy the token from the SCIM token field and keep it somewhere safe until you've pasted it into your identity provider. It starts with fgs_.

7. Click I've copied it. This is the only way to close the dialog. Pressing Esc or clicking outside it does nothing, so you can't lose the token by accident.

Fugo only shows the token once. Fugo doesn't keep a readable copy, so it can't show you the token again. If you lose it, rotate the token to get a new one (see Rotate token).

Once your identity provider starts using the token, the section shows roughly when it was last used, so you can see at a glance that provisioning is running (see Token status).

Step 2: Connect Microsoft Entra ID

Do this in the same Enterprise application you set up for Fugo SSO.

Turn on provisioning

  1. In the Microsoft Entra admin center, go to Identity > Applications > Enterprise applications and open your Fugo app.

  2. Open Provisioning and click New configuration.

  3. Under Admin credentials, fill in:

    • Select authentication method: Bearer authentication

    • Tenant URL: your SCIM base URL from Fugo, exactly as shown. Don't add /Users or a trailing slash.

    • Secret token: your SCIM token from Fugo

  4. Click Test connection. Create stays greyed out until the test succeeds.

  5. Click Create.

If your tenant still shows the older layout, set Provisioning Mode to Automatic, fill in the same two fields under Admin Credentials, click Test Connection, then Save.

Check the mappings

  1. Still in Provisioning, open Mappings.

  2. Open Provision Microsoft Entra ID Groups and set Enabled to No. Fugo doesn't support group provisioning (see Good to know).

  3. Open Provision Microsoft Entra ID Users. The default mappings work. Check these four:

    • userName: userPrincipalName

    • active: Switch([IsSoftDeleted], , "False", "True", "True", "False")

    • emails[type eq "work"].value: mail

    • name.givenName and name.familyName: givenName and surname

    Fugo uses the work email as the person's sign-in address. If some of your users have no mail attribute in Entra, map userName to an address in your SSO domain instead.

You can leave Entra's other default attributes (job title, phone numbers, address and so on) as they are. Fugo ignores what it doesn't use. That includes displayName, because Fugo takes each person's name from name.givenName and name.familyName only.

To set each person's role and Space from Entra, add the Fugo attributes now (see Choosing a role and Space for each person below).

Choose who gets provisioned and start

  1. Under Settings, set Scope to Sync only assigned users and groups.

  2. Assign the people (or groups of people) who should have Fugo accounts under Users and groups in the app, as you did for SSO.

  3. Set Provisioning Status to On and click Save.

Entra runs its first sync within about 40 minutes and then keeps things in sync on a regular cycle. To check one person straight away, open Provision on demand, pick them and click Provision. All four steps should come back as Success.

If someone already had a Fugo account with the same email, step 4 says they were updated rather than created. That's expected, because Entra found the existing account and linked to it instead of making a second one.

Step 3: Connect Okta

Do this in the same app integration you set up for Fugo SSO.

Turn on provisioning

  1. In the Okta Admin Console, go to Applications > Applications and open your Fugo app.

  2. On the General tab, click Edit under App Settings, set Provisioning to SCIM, and click Save.

  3. Open the new Provisioning tab and click Edit under SCIM Connection.

  4. Fill in:

    • SCIM connector base URL: your SCIM base URL from Fugo

    • Unique identifier field for users: userName

    • Supported provisioning actions: tick Push New Users and Push Profile Updates. Leave Push Groups and Import Groups unticked.

    • Authentication Mode: HTTP Header

    • Authorization: your SCIM token from Fugo

  5. Click Test Connector Configuration. Create Users and Update User Attributes should show as found.

  6. Click Save.

Turn on the provisioning actions

  1. On the Provisioning tab, open To App and click Edit.

  2. Enable Create Users, Update User Attributes and Deactivate Users.

  3. Click Save.

Make sure the app's Application username format (on the Sign On tab) is set to Email, so Fugo receives each person's work email.

Assign people

Assign people (or groups of people) to the app on the Assignments tab, as you did for SSO. Okta creates them in Fugo straight away.

To set each person's role and Space from Okta, add the Fugo attributes (see the next section).

Choosing a role and Space for each person

Fugo reads two optional custom attributes, role and space. They're the only way to set role and Space from your identity provider, because Fugo doesn't take them from groups or any other attribute. If you skip them, Fugo uses the defaults in the table below, and you can change roles in Fugo later.

Attribute

What to send

role

One of TenantAdmin or TenantMember (admin or member of the whole workspace), or TeamAdmin or TeamMember (admin or member of one Space).

space

The name of a Space, exactly as it appears in Fugo. Upper and lower case don't matter. The name must belong to only one Space in your workspace.

How Fugo combines them:

You send

The person ends up

TenantAdmin or TenantMember, no Space

At workspace level with that role

A Space, with TeamAdmin, TeamMember or no role

In that Space with that role, or as a Space member if no role is sent. If no Space has that name, or more than one does, the request fails.

TeamAdmin or TeamMember, no Space

In your workspace's default Space with that role. If you have no default Space, the request fails and your identity provider shows an error for that person.

Nothing

In your default Space as a Space member, or at workspace level as a workspace member if you have no default Space

Sending a workspace role (TenantAdmin or TenantMember) together with a Space doesn't work, because workspace roles aren't tied to a Space. Your identity provider will show an error for that person.

Missing attributes never make anyone an admin. On later updates, an attribute your identity provider doesn't send leaves that setting as it is.

You can't demote your only workspace admin. If a role or Space change would leave your workspace without an active workspace admin, Fugo refuses it. Make someone else a workspace admin first.

Role and Space aren't CMS permissions. SCIM doesn't set what people can do inside the CMS. Everyone added through SCIM gets the workspace's default access role (Owner unless you've changed it).

Adding the attributes in Entra ID

  1. In Provisioning > Mappings > Provision Microsoft Entra ID Users, tick Show advanced options and click Edit attribute list for customappsso.

  2. Add two attributes, both of type String:

    • urn:fugo:params:scim:schemas:extension:2.0:User:role

    • urn:fugo:params:scim:schemas:extension:2.0:User:space

  3. Save, then go back to the mappings and click Add New Mapping for each one. Choose where the value comes from, for example a user attribute like department or extensionAttribute1, or an expression.

Adding the attributes in Okta

  1. Go to Directory > Profile Editor and open your Fugo app's user profile.

  2. Click Add Attribute and create two attributes, both with Data type set to string:

    • Display name: Fugo role, Variable name: fugoRole, External name: role

    • Display name: Fugo space, Variable name: fugoSpace, External name: space

    For both, set External namespace to urn:fugo:params:scim:schemas:extension:2.0:User.

  3. Click Mappings and map each one from the Okta user profile, or set them per person on the app's Assignments tab.

If you already send fugo_role and fugo_space claims for SSO, use the same source values here.

What happens when someone leaves

When you unassign someone from the Fugo app, or deactivate them in your identity provider, Fugo switches their account off:

  • They can't sign in.

  • Their open sessions are signed out. Anything they're already signed in to stops working within about five minutes.

Switching them back on in your identity provider restores their access.

Entra ID also deletes the person's Fugo account 30 days after they're deleted in Entra. Okta never deletes accounts, only switches them off.

Deleting is permanent. When your identity provider deletes someone, Fugo deletes their Fugo account completely. This can't be undone.

Managing your SCIM token

Everything for SCIM lives in the User provisioning (SCIM) section of the Single sign-on tab. The section starts: Let Okta or Microsoft Entra ID add people to this workspace, keep their role and Space up to date, and switch them off when they leave. Paste the URL and token below into your identity provider's provisioning settings.

There's one SCIM token per workspace. Making a new one always replaces the old one.

SCIM base URL

This is the address your identity provider sends its provisioning requests to. You paste it into Entra as the Tenant URL or into Okta as the SCIM connector base URL.

It's https://api.fugo.ai/scim/v2 for every workspace and you can't change it. Use the copy button next to it so you don't mistype it.

Token status

Under the URL, Fugo shows whether provisioning is switched on:

  • No token yet. This is how every workspace starts. It reads There's no SCIM token yet, so provisioning is off. The only button is Generate token.

  • Token created. Once you have a token, the section shows the date you made it, for example Token created Oct 21, 2026. The buttons change to Rotate token and Revoke token.

  • Last used. Until your identity provider first connects, it reads Your identity provider hasn't used it yet. After that, it reads Your identity provider last used it around Oct 21, 2026, 3:04 PM. The time is in your computer's local time.

Fugo updates the last-used time at most once an hour. If your identity provider connected a few minutes ago, the time may not have moved yet. That doesn't mean provisioning has stopped.

If Fugo can't load the status, the section reads Couldn't check this workspace's SCIM token. Click Try again.

Rotate token

Rotating swaps your token for a new one. Do it if you've lost the token, or if you think someone else has seen it.

  1. Click Rotate token.

  2. Fugo asks Rotate the SCIM token? and warns: The current token stops working straight away. Provisioning pauses until you paste the new token into Okta or Entra. Click Rotate token to go ahead, or Cancel.

  3. Copy the new token from the Your new SCIM token dialog and click I've copied it, as in Step 1.

  4. Paste the new token into your identity provider (the Secret token in Entra, or Authorization in Okta) and save.

The Settings window is hidden while these dialogs are open and comes back when you close them.

Revoke token

Revoking deletes the token and switches provisioning off. Do it when you no longer want Okta or Entra to manage people in this workspace.

  1. Click Revoke token.

  2. Fugo asks Revoke the SCIM token? and warns: Provisioning stops straight away. People already added keep their accounts, but changes in Okta or Entra won't reach Fugo until you generate a new token. Click Revoke token to confirm, or Cancel.

Nobody loses their account when you revoke. You manage those people in Fugo from then on. To start provisioning again, click Generate token and paste the new token into your identity provider.

If you remove SSO

If you delete your SSO configuration, an existing token keeps working until you revoke it.

The section warns: SSO is off, but this SCIM token still works. Revoke it unless you still want Okta or Entra to manage people here. The base URL is hidden and the only button is Revoke token.

Good to know

People already in Fugo aren't duplicated. Fugo never links an existing account when your identity provider creates someone, and it refuses an email or username that's already taken. A member of this workspace who hasn't been provisioned yet can still be matched by email when your identity provider looks them up first, which Okta and Entra normally do.

Name and email changes sync. When you change someone's first or last name in your identity provider, Fugo updates it. Display name doesn't sync.

Email changes sync too, but the new address must still be in one of your SSO domains and not already used by another Fugo account.

Groups aren't supported. Your identity provider can't push groups to Fugo, so set role and Space per person with the attributes above. You can still use groups in your identity provider to decide who gets assigned to Fugo.

Be careful with your last workspace admin. Fugo will switch off the only workspace admin if your identity provider asks it to. If that happens by mistake, nobody is left to fix the settings, so contact support@fugo.ai and we'll switch an admin back on.

Google Workspace can't provision users to Fugo. Google only provisions users into apps from its own catalog. Your team can still sign in with Google SSO, and accounts are created the first time each person signs in.

Troubleshooting

What you see

What to check

You can't find User provisioning (SCIM)

Check that you're a workspace admin, that SSO is set up, and that you're on the SSO summary rather than editing the SSO configuration.

Couldn't check this workspace's SCIM token.

Fugo couldn't load the token status. Click Try again.

Another admin just created a SCIM token. Rotate it if you need a new one.

Another workspace admin generated a token at the same time, and your workspace can only have one. Check with them before you change anything. If you need a new token, click Rotate token.

That didn't work. Please try again.

Generating, rotating or revoking failed. Try again in a moment.

Test Connection fails with an authorization error

The token was copied incompletely, or it has been rotated or revoked. Generate or rotate a token in Fugo and paste it again.

Some people aren't created, and the error mentions their email

Their email isn't in one of the domains listed in your SSO settings, or another workspace has claimed that domain for its SSO. Add the domain to SSO, or change the address in your identity provider.

The error says a Space wasn't found

The space value doesn't match a Space name in Fugo, or two Spaces share that name. Check the spelling, or rename one of the Spaces. If no Space was sent with a Space role, your workspace needs a default Space.

The error says the role doesn't fit

A workspace role (TenantAdmin or TenantMember) was sent together with a Space. Send a Space role instead, or no Space.

A role or Space change is refused

The change would leave your workspace without an active workspace admin. Make someone else a workspace admin first.

Every request fails

Your workspace may be suspended. Check Billing in Settings.

Entra shows the job as quarantined

Entra pauses provisioning when many requests fail in a row. Fix the cause from the provisioning logs, then click Restart provisioning.

Need more help?

Drop us a message using the chat box in the bottom right of the CMS, or reach our support team at support@fugo.ai.

Related Articles
Did this answer your question?