{"pageModel":{"attributes":{"id":"","name":"119466.dita","viewName":"DitaDetail"},"elements":{"ditaContent":{"name":"DITAContent","value":"
\r\n

Provision Users and Groups from Okta

\r\n
\r\n

Cisco Secure Access supports the provisioning of users and groups from the Okta identity provider (IdP).

\r\n

After you generate your System for Cross-domain Identity Management (SCIM) token in Secure Access, add the SCIM token in the Cisco User Management Connector app in the Okta portal.

\r\n

Then, provision users and groups to Secure Access through the app.

\r\n
\r\n

Limits and Best Practices

\r\n
    \r\n
  • Secure Access supports provisioning a maximum of 1000 groups from Okta. Any groups beyond this number that are in scope are not provisioned. Secure Access does not restrict the number of users that you can provision from Okta. For more information, see Limitations and Range Limits.
    • \r\n
  • To ensure that all users are provisioned, assign the Everyone group to the Cisco User Management Connector app. You can push other additional groups for group-based Secure Access rule enforcement.
    • \r\n
  • Okta does not support nested groups.
    • \r\n
  • If you previously imported groups from the on-premises AD and push the same groups from Okta, the groups from Okta do not overwrite the groups imported from the on-premises AD. You must reassign any group-based Secure Access policy rules to the groups imported from Okta.
    • \r\n
  • Provisioning large numbers of users and groups to Secure Access may take several hours.
    • \r\n
  • After the initial provisioning of users and groups, it can take up to one hour for subsequent changes to users and groups to reflect in Secure Access.
    • \r\n
  • Concurrent synchronization of the same users and groups from the on-premises AD and the Cisco User Management Connector app is not supported and leads to inconsistent policy enforcement.
    • \r\n
  • For IP-to-user mapping deployments, you must use an on-premises AD Connector. Okta does not store the private IP to AD user mappings.
    • \r\n
\r\n
\r\n
\r\n

Supported Features

\r\n

Secure Access supports these features in Okta:

\r\n
    \r\n
  • \r\nCreate Users—New users created in Okta are also created in Secure Access.
    • \r\n
  • \r\nUpdate User Attributes—Updates to a user's profile through Okta are pushed to Secure Access.
    • \r\n
  • \r\nDeactivate Users—Deactivating a user through Okta deactivates the user in Secure Access.
    • \r\n
  • \r\nGroup Push—Groups in Okta are pushed to Secure Access.
    • \r\n
\r\n
\r\n
\r\n

Refresh the SCIM Token

\r\n

We recommend that you refresh the SCIM token at least once every 90 days and immediately copy the SCIM token to the Cisco User Management Connector app on Okta.

\r\n

Refreshing the SCIM token is the responsibility of the administrator. Secure Access does not perform this action.

\r\n
\r\n
\r\n
\r\n","ditaVal":"","format":"html"},"bookTitle":{"value":""},"shortDescription":{"value":""}}},"parameters":{"appId":"SecureAccess","topicAlias":"provision-users-and-groups-from-okta"}}