Skip to content
  • There are no suggestions because the search field is empty.

SCIM Provisioning with Okta

If your organization uses Okta to manage your employees’ access to tools and services, you can take advantage of Okta’s “Provisioning” feature to automatically grant access to EasyLlama to your admin users and learners.

The integration between Okta and EasyLlama that enables this provisioning to occur is built around an industry-standard protocol known as SCIM (System for Cross-domain Identity Management). To learn more about how Okta works with SCIM, please see this article.

Additionally, Automations apply to SCIM-updated learners to automate actions such as assigning a course when a new learner is added, or assign a leadership course when a learner is promoted to supervisor. See this article for more details about EasyLlama's Automations. 

The remainder of this guide is focused on enabling you to configure both EasyLlama and Okta to get provisioning up and running for your organization.

Supported features:

  • Create admin users / learners
  • Update admin users / learners attributes
  • Deactivate admin users / learners

Before You Start

What You'll Need

  • Administrative access to the EasyLlama dashboard
  • Administrative access to the Okta Admin Console
  • Your EasyLlama Organization ID (provided by your Customer Success team)
  • Understanding of your organization's user attributes and mappings
  • Test user accounts for validation

Quick Reference

  • SCIM Tenant URL: Provided during Okta app configuration (uses your Organization ID)
  • Authentication: Configured via Okta's API Integration
  • Supported features: Create Users, Update User Attributes, Deactivate Users, Groups

Supported Fields

 

IMPORTANT: Only the EasyLlama fields listed below are supported.

 
 
EasyLlama Field SCIM Attribute Okta Variable Name Notes
First Name name.givenName firstName Standard mapping; required for all users
Last Name name.familyName lastName Standard mapping; required for all users
Email emails[type eq "work"].value email Standard mapping; required for admin users
User Type userType userType Determines permissions (values: admin, learner, admin, learner)
Training Tags training_tags training_tags Custom attribute for automatic course assignment
Title title title Standard mapping
Role learnerRole learnerRole Custom attribute (values: supervisor/non-supervisor)
Department urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department department Enterprise extension
Location urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:location location Enterprise extension
Country addresses.^[primary==true].country country Used with State to calculate Region
State addresses.^[primary==true].state state Used with Country to calculate Region

This is the complete and exhaustive list of supported SCIM attributes for EasyLlama. No other fields will be processed by the system, regardless of what is sent in the SCIM payload.

Important Notes

  • Admin users: First name, last name, and email address are required
  • Learners: First name and last name are required
  • Existing EasyLlama admins: When provisioning, you must set the User Type to admin or admin, learner — otherwise they will be removed from your account and lose access. Contact support@easyllama.com to restore access if this occurs.

Step-by-step configuration instructions

1) Click “Applications” > “Applications” > “Browse App Catalog“ (If you already have EasyLlama as an application, click on it).

  • Search for "EasyLlama"
  • Click Add
  • Click Done

2) Click the “Provisioning” tab and click “Configure API Integration“

3) Next, click the checkbox “Enable API Integration“.

4) Under the “Provisioning” tab, your EasyLlama organization ID and click "Save".

Your EasyLlama organization ID will be provided by your customer success team.

 

5) Next, on the “Provisioning” tab click “To App” and click “Edit“

6) Check each box for EasyLlama’s supported provisioning actions: 

  • Create Users
  • Update User Attributes
  • Deactivate Users

Click "Save".

9) Next, click the tab for “Sign On” and click “Edit“

10) Select Email for the Application username format and click “save”

 

How to provision learners or admins into EasyLlama

1) In Okta, go to Directory > People

2) Add a new user or select an existing one

3) Click "Assign Applications" and select the application you just installed, "EasyLlama SCIM".

4) A form will appear. You can also enter the "User Type" such as "admin", "learner" or both "admin, learner".

WARNING: for existing EasyLlama admins, you must set this field to "admin" or "admin, learner" otherwise they will be removed from your account and they won't be able to access the EasyLlama LMS anymore. You will need to contact support@easyllama.com to get their access reinstated.

 

5) Click "Save".

6) Learners will be provisioned in your EasyLlama account and will be assigned training courses (if selected).

To automatically assign training courses when provisioning learners

You can assign courses to learners when they are provisioned through Okta SCIM for the first time (new learners only). To do this, follow these steps to add a training_tags column in the Okta profile editor:

1) After having installed the EasyLlama Okta app, go to Directory > Profile Editor

2) Click on "Add Attribute" and enter the following information:

  • Display name: EasyLlama Training Tags
  • Variable name: training_tags
  • External name: training_tags
  • External namespace: urn:ietf:params:scim:schemas:core:2.0:User

Then click "Save".

 

3) (optional) To map your core User fields to the EasyLlama app, click on "Mappings", then on "Okta User to EasyLlama" and map your user field to the EasyLlama training_tags. Click "Save".

4) When provisioning a new user in Okta and assigning them the EasyLlama app, you will have the opportunity to enter the EasyLlama training tags to automatically assign specific courses to learners. For example, you can enter the hp-self-select code to assign the Harassment Prevention Training Self-Select. Since these tags were previously only used for file uploads/feeds, they are located under File upload information in the dashboard. You can find instructions here to locate them: Adding Learners using the File Upload Method -> How to get the Training Codes/Learning Journey codes.

 

5) That's it! New learners should appear in your EasyLlama dashboard with trainings assigned.

Additional Learner Profile Configuration (Optional)

Additional user attributes from SCIM can be set up and mapped to EasyLlama:

  • Title
  • Role
  • Department
  • Location
  • Region (Country and State)

Title

  1. Go to Okta > Directory > Profile Editor > EasyLlama App
  2. Add Title if it isn't already an attribute in the EasyLlama App
    1. Variable name: title
    2. External name: title
    3. External namespace: urn:ietf:params:scim:schemas:core:2.0:User
    4. Click Save
  3. Map Title from Okta to EasyLlama
    1. Click Mappings in the Profile Editor for the EasyLlama App
    2. Select the tab Okta User to EasyLlama App
    3. Map user.title to title

Role

  1. Go to Okta > Directory > Profile Editor > EasyLlama App
  2. Add Role if it isn't already an attribute in the EasyLlama App
    1. Variable name: learnerRole
    2. External name: learnerRole
    3. External namespace: urn:ietf:params:scim:schemas:core:2.0:User
    4. Click Save
  3. Go to Okta > Directory > Profile Editor > Okta User
  4. Add Role if it isn't already an attribute in Okta
    1. Variable name: learnerRole
    2. Define enumerated list of values: true
      1. Display name and Value: non-supervisor
      2. Display name and Value: supervisor
    3. Click Save
  5. Map Role from Okta to EasyLlama
    1. Click Mappings in the Profile Editor for the EasyLlama App
    2. Select the tab Okta User to EasyLlama App
    3. Map user.learnerRole to learnerRole

Department

  1. Go to Okta > Directory > Profile Editor > EasyLlama App
  2. Add Department if it isn't already an attribute in the EasyLlama App
    1. Variable name: department
    2. External name: department
    3. External namespace: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
    4. Click Save
  3. Map Department from Okta to EasyLlama
    1. Click Mappings in the Profile Editor for the EasyLlama App
    2. Select the tab Okta User to EasyLlama App
    3. Map user.department to department

Location

  1. Go to Okta > Directory > Profile Editor > EasyLlama App
  2. Add Location if it isn't already an attribute in the EasyLlama App
    1. Variable name: location
    2. External name: location
    3. External namespace: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
    4. Click Save
  3. Go to Okta > Directory > Profile Editor > Okta User
  4. Add Location if it isn't already an attribute in Okta
    1. Variable name: location
    2. Click Save
  5. Map Location from Okta to EasyLlama
    1. Click Mappings in the Profile Editor for the EasyLlama App
    2. Select the tab Okta User to EasyLlama App
    3. Map user.location to location

Region

Region is calculated in EasyLlama from the SCIM attributes for Country and State, not from a Region attribute.

Country

  1. Go to Okta > Directory > Profile Editor > EasyLlama App
  2. Add Country if it isn't already an attribute in the EasyLlama App
    1. Variable name: country
    2. External name: addresses.^[primary==true].country
    3. External namespace: urn:ietf:params:scim:schemas:core:2.0:User
    4. Click Save
  3. Map Country from Okta to EasyLlama
    1. Click Mappings in the Profile Editor for the EasyLlama App
    2. Select the tab Okta User to EasyLlama App
    3. Map user.countryCode to department

State

  1. Go to Okta > Directory > Profile Editor > EasyLlama App
  2. Add State if it isn't already an attribute in the EasyLlama App
    1. Variable name: state
    2. External name: addresses.^[primary==true].state
    3. External namespace: urn:ietf:params:scim:schemas:core:2.0:User
    4. Click Save
  3. Map State from Okta to EasyLlama
    1. Click Mappings in the Profile Editor for the EasyLlama App
    2. Select the tab Okta User to EasyLlama App
    3. Map user.state to state

Manager

  1. Go to Okta > Directory > Profile Editor > EasyLlama App
  2. Add Manager if it isn't already an attribute in the EasyLlama App
    1. Variable name: manager
    2. External name: manager
    3. External namespace: urn:ietf:params:scim:schemas:extension:enterprise:2.0:User
    4. Click Save
  3. Map Manager from Okta to EasyLlama
    1. Click Mappings in the Profile Editor for the EasyLlama App
    2. Select the tab Okta User to EasyLlama App
    3. Map Okta’s manager field (commonly user.manager / manager DN / email, depending on your Okta setup) to manager

Note

For admin users: first names, last names and email addresses are required

For learners: first names and last names are required

How Manager matching works:

  • EasyLlama resolves the manager value against learners in this order:SCIM UUID → employee number (employeeNumber / internal ID) → email.

  • The manager must already be provisioned into EasyLlama (active or on leave).

  • A user cannot be set as their own manager.

  • Removing/clearing manager in Okta clears the manager in EasyLlama.

  • If the reference doesn’t match anyone, the existing manager is left unchanged.