Provision people from Okta

Let Okta add, change and remove people and teams through SCIM.

In short

Connect Okta once. People you assign to the app join the organization, changes follow, and pushed groups become teams.

Open your organization, then Settings › "Security and data", and find "Provisioning (SCIM)".
Copy the "SCIM address".
Optional: tick "People it adds may take a paid seat". Leave it off to keep provisioning within the seats you have.
Press "Make a token" and copy the token. It is shown only this once.

In the Okta Admin Console open "Applications" › "Applications" › "Create App Integration", choose "SWA" or "SAML 2.0", and finish the app.
On the app's "General" tab press "Edit" under "App Settings", tick "Enable SCIM provisioning" and save.
On the "Provisioning" tab press "Edit": paste the SCIM address into "SCIM connector base URL", type userName as "Unique identifier field for users", tick "Push New Users", "Push Profile Updates" and "Push Groups", choose "HTTP Header" as "Authentication Mode" and paste the token into "Authorization". Press "Test Connector Configuration", then "Save".
Under "Provisioning" › "To App" press "Edit", turn on "Create Users", "Update User Attributes" and "Deactivate Users", and save.
On "Assignments" assign the people and groups; on "Push Groups" push the groups that should become teams.

"Test Connection" fails with 401: paste the token again, or make a new one - the old one may have been replaced.
People are not added: check they are assigned to the app, and that seats are free or "People it adds may take a paid seat" is ticked.
"What it did" says what each call changed, so you can see which person or group a failure was about.

People the provider adds join as members; people it pauses or removes lose their sign-in and their seat. Their work stays.
Groups become teams with the same names, and their members follow the group.
"What it did" lists the last 50 changes the provider made, and the section shows when it last called.
"Make a new token" stops the old one at once; "Turn off provisioning" stops it without a new one.
Plan: provisioning comes with the Enterprise plan, and the 14-day trial has it.