Company logoHelp Center
Visit www.threatlocker.com

Setting Up the ThreatLocker SCIM User & Group Sync with Okta

4 min. readlast update: 10.26.2026

Coming Soon!

ThreatLocker's SCIM (System for Cross-domain Identity Management) User & Group Sync allows you to synchronize users and groups from Okta into ThreatLocker for use in security policies.

Once configured, the integration allows you to manage users and group memberships through Okta without having to maintain this information separately in ThreatLocker.

Important: This integration is intended for users and groups referenced in ThreatLocker policies. It does not create ThreatLocker Portal administrators, assign User Roles, or grant users access to the ThreatLocker Portal.

ThreatLocker Portal Setup

In the ThreatLocker Portal, navigate to Manage > Integrations.

Type SCIM in the searchbar to search for the User & Groups Sync.

Select SCIM User & Group Sync to open the integration sidebar.

Configure the following settings:

  1. Enabled: The integration is enabled by default. Leave this toggle on.

  2. API URL: Displays the SCIM endpoint URL that you will use when configuring the integration in Okta.

  3. Generate API Token: Select this button to generate the bearer token required to authenticate requests from Okta.

Important: The API token is displayed only once. Copy and store it securely before proceeding, as you will need it to complete the Okta configuration.

Select Save to save the integration settings.

Okta Portal Setup

Create the SCIM Integration

  1. Log in to the Okta Admin Console.

  2. Navigate to Applications and Resources > Applications.

  3. Select Create App Integration.

The Okta Integration Wizard will open. Select Next to continue.

On the Add integration capabilities screen, enable Provisioning and select SCIM 2.0.

Under Integration details, enter a Display name and Description to identify the integration.

in Tenant settings, if desired, enter a Label and a Name for the integration.

Under Authentication settings, select Bearer as the Authentication mode.

Select Configure your integration to continue.

Configure SCIM Synchronization

Configure the following settings:

    1. Base URL: Enter the API URL copied from the ThreatLocker SCIM integration sidebar.

    2. Resources: Users is selected by default. Select Groups to enable group synchronization.

    3. User Operations: Select the user operations you want Okta to synchronize with ThreatLocker. We recommend enabling all available operations except Change password, as passwords are not required or supported for users referenced in ThreatLocker policies.

Select the Review and deploy button to save and deploy the integration.

Configure API Authentication

  1. Navigate to the Provisioning tab.

  2. Select Configure API Integration.

Ensure the Enable API integration checkbox is selected.

In the API Token field, enter the token generated in the ThreatLocker SCIM integration sidebar.

Select Test API Crendentials to verify the connection between Okta and ThreatLocker.

Once the test completes successfully, select Save.

Enable User Provisioning

  1. Select To App under Settings.

  2. Select Edit to configure the provisioning settings.

Enable the following options:

  • Create Users: Synchronizes new users assigned to the integration.

    • Deselect Set password when creating new users.

  • Update User Attributes: Synchronizes changes to existing user information.

  • Deactivate Users: Synchronizes user deactivation events to ThreatLocker.

Select Save to apply the provisioning settings.

Assign Users and Groups

Next, specify which users should be synchronized to ThreatLocker.

  1. Navigate to the Assignments tab.

  2. Select the option to assign groups to the integration.

Search for and select the Okta groups containing the users you want to make available for ThreatLocker policies.

Note: Assigning a group to the application allows Okta to provision its members as users. To synchronize the groups themselves, you must also configure Group Push.

Configure Group Push

  1. Navigate to the Push Groups tab.

  2. Add the Okta groups that you want to synchronize to ThreatLocker.

  3. Ensure the intended groups are configured for Group Push.

  4. Select Save to complete the configuration.

Group Push synchronizes the selected Okta groups and their memberships to ThreatLocker, allowing them to be referenced in security policies.

Verify the Integration in ThreatLocker

Once the Okta configuration is complete, return to the ThreatLocker Portal.

  1. Navigate to Manage > Integrations.

  2. Open the SCIM User & Group Sync integration sidebar.

  3. Locate the SCIM Provider Groups section.

The synchronized Okta groups will be displayed in this section. Select the expand icon next to a group to view its members.

Using Synchronized Users and Groups in Policies

Once synchronized, Okta users and groups will be available in the Selected Users & Groups dropdown when creating or editing supported ThreatLocker policies.

This allows you to apply policies to users and groups managed in Okta without having to maintain those identities separately in ThreatLocker.

Was this article helpful?