To learn more about single sign-on, read our SAML guide.
How does this app work?
If your team uses Okta for employee provisioning, you can use this app to automatically keep your Envoy employee directory up to date. The SCIM push-based system treats the Okta directory as your source of truth. When changes are made in Okta, they push immediately to Envoy, so you don’t have to worry about the Envoy employee directory being out of sync with Okta.
Note: You can manually create new employees or add employees from other locations, if they are not set to be provisioned through Okta, while maintaining your directory sync. This feature is helpful for contractors, temps or other people who may host visitors/receive deliveries but are not core team members. Learn more about manually adding employees.
A few notes on SCIM
The SCIM standard enables advanced provisioning in order to automate user lifecycle management for an application, including account creation, profile updates, authorization settings, and account deactivation.
Enabling Envoy + Okta employee provisioning
Note: You'll need to have LCM in Okta to use it as a directory application in Envoy. You’ll also need to have Okta application administrator privileges or higher to complete this setup. To learn more about Okta’s administrator role structure, please view their admin guide. Either become an admin or ask your admin in IT for help before completing these steps:
Step one: Prepare to enable Envoy + Okta employee provisioning (with SCIM)
Decide whether you’d like to sync all users to all locations or sync specific users per location. This will impact how you set up the app.
Step two: Enable Envoy + Okta employee provisioning (with SCIM)
Note: You’ll need to be an admin on your Okta account to complete this setup. Either become an admin or ask your admin for help before completing these steps:
Step three: Choose an employee sync filter
When you connect an Okta account, you have two options on how to sync employees to your directory. Choose the one that’s right for you:
Sync all employees: This is good for companies with one location, or if you prefer to have the same master Envoy employee directory at all locations within your company.
Sync specific employees per location: Choose this option if you’d like to sync certain Okta users to certain locations (i.e., creating different Envoy employee directories per location). You can filter employees by location in Envoy based on available filters sent from Okta, which are currently “city” and “locale.”
Step four: Configure Okta settings
In your Okta account, request a new application for Envoy. To do this, you’ll need to be an Okta admin.
Go to the Okta provisioning page, and click “Configure API Integration.”
Copy the Oauth Bearer Token from Envoy and enter it in the API Token field in Okta.
Check the "Enable API Integration"
Test API connect > Save.
Make sure that “Create Users,” “Update User Attributes,” and “Deactivate Users” are all set to enable (box checked).
Click “Save” at the bottom of the Okta provisioning page.
✨Paste the bearer token into Okta before provisioning groups/users to the Envoy application!✨
Go to the Okta groups page.
Click “Assignments,” and select all employees or groups you’d like to sync to the Envoy employee directory.
We recommend selecting “Everyone,” but you can also assign individual employees from the Okta people page.
Navigate back to the Envoy Employee directory > All employees and refresh. Your employees should have imported automatically. (This can take ~30 minutes for the first sync)
Regarding adding employees
When updating or adding employees, Envoy will match based on the primary email address listed for the Okta user. If the primary email address is not found in Envoy, a new employee will be added to the Envoy employee directory.
Regarding employee contact information
The primary email address and phone number listed in Okta will be the email address and phone number listed in the Envoy employee directory.
If an Okta user does not have a primary email address, they will not be synced to the Envoy employee directory.
Add Envoy Assistants from Okta
Go to your Okta Directory.
Select the employee to which you’d like to assign an assistant.
Go to their Profile tab and click “edit.”
Scroll all the way to the bottom; find Assistants, and click “Add another.”
Note: If the Assistants field isn’t already part of your Okta user profile, you will need to add this field to support syncing assistants via user provisioning. Here’s how: In Okta, go to Directory > Profile Editor > Okta and click “Profile.” Click “Add attribute.” Set up the Assistants profile attribute as a string array, as depicted below.
Type in the assistant’s email address, and click “Save.”
If you need to add multiple assistants, repeat steps four and five.
Go to the Applications tab and select Envoy application.
Click “Provisioning” and scroll down to “Show Unmapped Attributes”.
Select pen to edit assistants, set “Attribute value” equal to “Expression”, enter “
user.assistants” into text field, and assign radio button to “create and update” for Apply On.
Check your Envoy employee directory, and your assistants should be automatically assigned.
Note: If you plan to assign assistants manually within the web dashboard, please reach out to Envoy Support prior to setting up SCIM syncing to configure this on your account.
Users not pulling through
If you notice that your users are not coming through once you've set up the app, go to the Provisioning tab > remove all groups/users provisioned > add them back. This should kickstart the sync and you should start to see users within ~5 minutes.
You've done the above but it still isn't syncing users
Go into your Okta Envoy application, remove all users/groups from the Provisioning tab
Go to Envoy's integration dashboard > Click "Configure" on Okta > Click "Regenerate token"
Go back to Okta's Envoy application > Provisioning tab > Integration section > Edit > Paste the new bearer token
Go into "To App" and re-add all users/groups
✨You should see your employees in Envoy's Employee directory within 30 minutes.✨
Assistants are mapped but not appear in Envoy
Ensure that the assistant is also in the users being provisioned into Envoy
Go to the Profile editor on Okta's provisioning page and click the pencil icon on the Assistants expression, it should look as follows
You will want to be sure that the Variable name and the External namespace look like the above screenshot.
The Variable name will be slightly different but it will look like
If the Variable name does not look like the above your assistant mapping will not send assistants to Envoy.
You will need to de-activate this app in Okta and re-generate your OAuth Bearer Token in Envoy (Enabled integrations > Configure on Okta > Regenerate token)
Follow the steps listed here to set up a new app in Okta.