SCIM Automated Provisioning & De-provisioning

1. In the Admin Console, go to Applications.
2. Click Create App Integration.
3. Select SAML 2.0 as the Sign-in method.
4. Click Next.
5. Provide the general information for the integration and then click Next.
6. Provide the necessary SAML settings information for your integration. See Application Integration Wizard SAML field reference for descriptions of individual fields.
7. Click Preview the SAML Assertion to view the XML generated from the SAML settings that you provided.
8. Click Next.
9. Provide configuration information about your app integration to Okta:
   • If you're adding an integration for internal use only, follow these steps:
     1. Select I'm an Okta customer adding an internal app.
     2. Select This is an internal app that we have created. However, if your app requires more SAML configuration instructions to work with Okta, select It's required to contact the vendor to enable SAML. Fill in the provided fields to help the Okta support team understand your SAML configuration.
     3. Click Finish.
   • Your integration is created in your Okta org. You can modify your integration's parameters and assign it to users.
10. After you create your SAML app integration, you can proceed to follow the steps for Enabling SCIM in Fullstory.

Create a custom (non-gallery) enterprise application in Microsoft Entra ID, then configure SAML single sign-on on it. Refer to Microsoft's documentation for the steps:

1. Create the app by selecting Create your own application and Integrate any other application you don't find in the gallery (Non-gallery). See Integrate a SCIM endpoint with a non-gallery application.
2. Configure SAML on the new app. See Enable SAML single sign-on for an enterprise application. You'll get the values Entra asks for (Entity ID and ACS URL) from Configuring SCIM in Fullstory.
3. After you create your SAML app, you can proceed to follow the steps for Enabling SCIM in Fullstory.

The following steps provide an example of how to configure SCIM with Okta. The specific steps may vary depending on your IdP.

1. From your Okta Admin console, navigate to Applications > Applications.
2. Select the Okta Application that you have configured for Fullstory SSO.
3. For the selected Okta Application, click the General tab and then click Edit.
4. Under Provisioning, select SCIM and click Save. This will add a Provisioning tab to your Fullstory Okta application.
5. Click the new Provisioning tab.
6. Under Integration, click Edit.
7. Using the information obtained from Fullstory in the previous section, fill out the following details:
   • SCIM connector base URL.
   • Unique identifier field for users: userName
   • Supported provisioning actions.
   • Authentication Mode.
   • Authorization token.
8. Click Test Connector Configuration.
9. If the test is successful, click Save.

Mapping User Roles via SCIM Attributes (Recommended)

To automatically assign Fullstory roles to users based on their group memberships in Okta, follow these steps:

1. In Okta, navigate to Directory > Profile Editor.
2. Select your Fullstory Okta Application and click + Add Attribute.
3. Fill out the attribute details with the following information:
   1. Data Type: String.
   2. Display Name: Fullstory Role.
   3. Variable Name: role
   4. External Namespace: urn:ietf:params:scim:schemas:extension:fullstory:2.0:User
   5. Define enumerated list of values: Checked.
4. Add the following Attribute Members with their corresponding Value (Note: The umbrella manager role is not supported via SSO role mapping or SCIM attributes):
   1. Admin: admin.
   2. Architect: architect.
   3. Standard: standard.
   4. Explorer: explorer.
   5. Guest: guest.
5. Ensure Attribute Type is set to Group.
6. Click Save.
7. In Okta, navigate back to your Fullstory Okta application and click the Assignments tab.
8. Add the groups you want to map to Fullstory roles.
9. Click the pencil icon to open the Edit Group Assignment screen. You should now see the Fullstory Role attribute.
10. Select the desired Fullstory role from the dropdown that you want to assign to members of this Okta group.
11. Click Save and repeat this for all relevant Okta groups.

Enabling SCIM Functionality in the Fullstory Okta App

1. From the Okta Application, navigate to Provisioning > To App and click Edit.
2. Select the provisioning features you want Okta to manage. It is recommended to enable Create Users, Update User Attributes, and Deactivate Users.
3. Click Save.

Converting Existing Users to SCIM Users (If Applicable)

If you already have users assigned to the Fullstory Okta application before configuring SCIM, you may need to manually provision them via SCIM:

1. In the Okta Application, navigate to the Assignments tab.
2. Click Import Now to reconcile any differences between the users currently in Fullstory and those assigned in Okta.

The following steps provide an example of how to configure SCIM with Microsoft Entra ID. Fullstory's published Entra ID gallery application ("Fullstory SAML") supports single sign-on, but it doesn't have an approved SCIM listing with Microsoft yet. To enable SCIM provisioning, create a second, separate application dedicated to provisioning; keep your existing "Fullstory SAML" application configured for sign-in. The application you create below is used only for provisioning and won't appear as a sign-in option for your users.

Create a provisioning app in Microsoft Entra ID

1. Sign in to the Microsoft Entra admin center as at least an Application Administrator.
2. Browse to Entra ID > Enterprise apps > New application.
3. Select Create your own application.
4. Enter a name that's easy to tell apart from your SSO app (for example, "Fullstory SCIM"), select Integrate any other application you don't find in the gallery (Non-gallery), then click Create.

Configure the SCIM connection

1. In your new application, select Provisioning in the left panel, then click Get started.
2. Set Provisioning Mode to Automatic.
3. Under Admin Credentials, using the information obtained from Fullstory in the Enabling SCIM in Fullstory section above, enter the following:
   • Tenant URL.
   • Secret Token.
4. Click Test Connection. Microsoft Entra ID confirms it can reach Fullstory's SCIM endpoint.
5. If the test is successful, click Save.

Mapping User Roles via SCIM Attributes (Recommended)

To automatically assign Fullstory roles to users based on an app role assignment in Microsoft Entra ID, follow these steps:

1. Add a role attribute to the app's schema:
   1. In your provisioning app, select Mappings, then Provision Microsoft Entra ID Users.
   2. Select Advanced options, then Edit attribute list for [your app name]. (If this option isn't available, first visit https://portal.azure.com/?Microsoft_AAD_Connect_Provisioning_forceSchemaEditorEnabled=true to enable the schema editor, then return to this page.)
   3. At the bottom of the attribute list, add a new attribute with the following details, then click Add Attribute:
      • Name: urn:ietf:params:scim:schemas:extension:fullstory:2.0:User:role
      • Type: String.
      • Multi-value: No.
   4. Click Save.
2. Define app roles matching Fullstory's roles:
   1. Browse to Entra ID > App registrations > All applications, and select the same application you created for SCIM.
   2. Select App roles > Create app role.
   3. Create one role for each Fullstory role you want to support, setting Allowed member types to Users/Groups (Please note: The umbrella manager role is not supported via SSO role mapping or SCIM attributes):
      • Admin: admin.
      • Architect: architect.
      • Standard: standard.
      • Explorer: explorer.
      • Guest: guest.
   4. Click Apply after each role.
3. Map the role attribute (Please note: Assign only one app role per user. Microsoft Entra ID doesn't guarantee which role is provisioned if a user is assigned more than one):
   1. Return to your provisioning app's Mappings > Provision Microsoft Entra ID Users.
   2. Click Add New Mapping.
   3. Set Mapping Type to Expression.
   4. Enter the expression: SingleAppRoleAssignment([appRoleAssignments])
   5. Set Target attribute to urn:ietf:params:scim:schemas:extension:fullstory:2.0:User:role.
   6. Set Apply this mapping to Always.
   7. Click Ok, then Save.

Assigning users and groups, and starting provisioning

1. From your provisioning app, select Users and groups in the left panel, then Add user/group to assign the users or groups you want Microsoft Entra ID to provision to Fullstory. If you configured role mapping above, choose the matching role under Select a role for each assignment. (Please note: Microsoft Entra ID only provisions users and groups that are explicitly assigned the application. If you don't assign anyone, nothing will be provisioned.)
2. Select Overview in the left panel, then Start provisioning.
3. Select Provisioning logs in the left panel to monitor progress.

Things to know about Microsoft Entra ID provisioning

• Sync interval: After the initial provisioning cycle, Microsoft Entra ID checks for changes approximately every 40 minutes. This is normal behavior, not a sign of a broken connection. To provision a specific user immediately (for example, while testing), use Provisioning on-demand in the left panel of your provisioning app.
• Assigned-only provisioning: Microsoft Entra ID only provisions users and groups you've explicitly assigned to the app, unlike some Okta configurations that can provision more broadly.
• Deactivation, not deletion: As with Okta, when a user is unassigned or disabled in Microsoft Entra ID, Fullstory disables the corresponding user rather than deleting them. See What happens to a user when they're deprovisioned via SCIM? in the FAQs below.

By following these steps, you can successfully configure SCIM for your Fullstory organization, enabling automated user provisioning and deprovisioning through Microsoft Entra ID.

1. In the Okta Admin Console, navigate to Applications > Fullstory and confirm that provisioning is enabled under the Provisioning tab.
2. Within the Fullstory app in Okta, click the Push Groups tab. This is where you configure which Okta groups flow to Fullstory.
3. Click Push Groups and choose your push method:
   • Find groups by name: search for a specific Okta group and push it individually. Best for a small number of groups.
   • Find groups by rule: define a pattern matching on group name or description to push multiple groups at once. Best for many groups that follow a naming convention.
4. For each group you select, Okta checks whether a matching group already exists in Fullstory:
   • If a match is found, click Link Group to connect the Okta group to the existing Fullstory group and hand membership control to Okta. Existing permission assignments on the group are preserved.
   • If no match is found, Okta creates a new group in Fullstory automatically.
5. After selecting your groups, click through to push. Then, in Fullstory, go to Settings > Account Management > Groups. Your pushed groups appear with a SCIM-managed badge, and membership editing for those groups is disabled in the Fullstory UI.
6. Assign permissions to your groups in Fullstory. SCIM manages who is in each group; Fullstory manages what each group can access. See Fine-Grained Access Controls for Spaces to assign space access to your groups. If you linked to existing groups, their permission assignments are already in place.

Fullstory's Okta integration uses a custom SAML app, so Okta sends PUT requests for all group updates, including name changes and membership changes. This means every group update includes the full group object (the name and complete membership list) rather than incremental add/remove operations. This is expected behavior and works correctly with Fullstory's SCIM endpoint; no action is needed on your part, but it's worth understanding if you're troubleshooting or monitoring SCIM traffic.

Microsoft Entra ID is also supported for SCIM Groups, using the same provisioning app you configured for user provisioning above.

1. In your Fullstory provisioning app in Microsoft Entra ID, select Mappings and confirm Provision Microsoft Entra ID Groups is enabled (it's on by default unless it was previously turned off).
2. Assign the groups you want to sync to Fullstory the same way you assign users: select Users and groups > Add user/group, then choose a group instead of an individual user.
3. In Fullstory, go to Settings > Account Management > Groups. Groups pushed from Microsoft Entra ID appear with a SCIM-managed badge, and membership editing for those groups is disabled in the Fullstory UI.
4. Assign permissions to your groups in Fullstory. See Fine-Grained Access Controls for Spaces to assign space access to your groups.

Unlike Okta, Microsoft Entra ID sends incremental PATCH requests for group updates: separate operations for adding members, removing members, and renaming a group, rather than the full group object every time. This is standard SCIM behavior and works correctly with Fullstory's SCIM endpoint; no action is needed on your part.