Okta SCIM Provisioning for Airbyte

Connect Okta to your Airbyte workspace and let Okta manage the full user lifecycle: provisioning, entitlement assignment, and removal. Redblock sits between Okta and Airbyte as a certified SCIM bridge, so Airbyte behaves like any other SCIM-enabled app in your Okta org.

Setup takes about 30 minutes end to end. You'll spend most of it in two consoles: Redblock AI Studio (where a certified Airbyte Agent does the heavy lifting) and your Okta Admin Console.

Every SCIM request Okta sends is executed in Airbyte by a Redblock certified Agent: a pre-trained, pre-certified automation that already knows how to create accounts, assign entitlements, and remove users in Airbyte. You never train anything. You connect a service account, deploy a blueprint, and hand two values to Okta.

This integration is published in the Okta Integration Network (OIN) as Airbyte By Redblock and runs over the standard SCIM 2.0 protocol with header authentication.

Prerequisites

What you need:

• Redblock AI Studio access. New to Redblock? Write to support@redblock.ai and our team will provision your tenant
• An Airbyte service account: username, password, and your workspace login URL. If the account uses MFA, have its TOTP seed ready
• Okta admin access with permission to add applications and configure provisioning
• Entitlement Management available in your Okta org (part of Okta Identity Governance) if you want entitlement assignment through Okta

Supported Features

• Create Users: users assigned to the application in Okta are created in Airbyte
• Deactivate Users: users unassigned or deactivated in Okta are removed from Airbyte. Airbyte accounts are removed, not suspended
• Entitlement Management: Airbyte roles surface in Okta as entitlements, so access changes flow through Okta
• Import New Users: existing Airbyte accounts are imported into Okta and matched to Okta users for assignment
• Import Profile Updates: attribute changes made in Airbyte are reflected in Okta on each import

Not supported today: Update User Attributes (pushing profile changes from Okta to Airbyte), password sync, and Group Push. See Troubleshoot.

Configuration Steps

These steps follow your journey end to end: add the integration in Okta, get Redblock AI Studio access, complete the setup through the AI Studio Product Guide, then finish the provisioning configuration in Okta with the two values you collected.

Add the Airbyte By Redblock integration

1. In the Okta Admin Console, go to Applications → Applications and click Browse App Catalog.
2. Search for Airbyte By Redblock and open the SCIM integration.

Airbyte By Redblock in the Okta App Integration Catalog

3. Click Add Integration.

Airbyte By Redblock integration page

4. In General Settings, set the Application label (we recommend your Redblock deployment name, so the two consoles stay easy to correlate) and paste the Redblock SCIM Base URL from your AI Studio deployment. Complete setup in the AI Studio Product Guide below shows where to find it.
5. Click Done.

General Settings: application label and Redblock SCIM Base URL

You can review or update the SCIM Base URL any time on the application's General tab, under App Settings.

App Settings on the General tab

Get Redblock AI Studio access

Provisioning for Airbyte runs through Redblock AI Studio. If your organization does not have AI Studio yet, write to support@redblock.ai or contact your Redblock account team. They will provision your tenant and share your console URL and admin credentials.

Console URLs are specific to your deployment: SaaS tenants and VPC-hosted deployments use different domains, so use the address your account team shares.

Complete setup in the AI Studio Product Guide

Detailed, screenshot-by-screenshot instructions for the Airbyte flow live in the AI Studio Product Guide, right inside your console:

1. Sign in to your Redblock AI Studio console.
2. Click your username initials at the bottom-left corner and click Product Guide.

Product Guide opens from the user menu

3. Scroll down to the All Sections area and open Integrations. Follow the Airbyte setup guide for Okta SCIM end to end. In about 15 minutes you will add the certified Airbyte Agent, connect its identity with your Airbyte service account, create the deployment from the Airbyte Okta SCIM Activation blueprint, run Account Aggregation once, and deploy.

When you finish, you'll have the two values Okta needs:

• SCIM Base URL: shown in your deployment's Review & Deploy → Deploy section, in the format https://<your-api-domain>/<deployment-id>/scim/v2. Copy it exactly as your console shows it.
• Access Key: generated from the Access Keys page. Copy it when it is shown and store it in your credential vault; you'll paste it into Okta as the API Token.

Back in Okta, finish the provisioning configuration with the steps below.

Set the application username format

1. Open the application's Sign On tab and click Edit.
2. Set Application username format to Email. Airbyte identifies users by email address, and the SCIM userName value follows the same format.
3. Click Save.

Enable Entitlement Management

1. Open the application's General tab and click Edit.
2. Set the Entitlement Management dropdown to Enabled and click Save.

Enable Entitlement Management on the General tab

Configure the SCIM connection

1. Open the Provisioning tab and click Configure API Integration.
2. Check Enable API Integration.
3. Set the API Token to the Access Key you generated in AI Studio.
4. Uncheck Import Groups.
5. Click Test API Credentials and confirm the connection succeeds, then click Save.

Verify entitlements

1. Open the application's Governance section.
2. Confirm the Airbyte roles populated automatically. Redblock aggregates them from your workspace, so what you see in Okta matches what exists in Airbyte.

Map attributes and import users

1. Open the application's Profile Editor, go to Mappings, and confirm the userName mapping exists for App User → Okta User. Add it if missing, then click Save Mappings and apply the updates.
2. Back on the application, open the Import tab and click Import Now.
3. Review the imported Airbyte accounts, select the assignments you want, and click Confirm Assignments.

Test the Integration

Before rolling out to real users, push one test user through the full loop.

1. In Okta, assign a test user to the application (Assign → Assign to People), selecting an entitlement.
2. Give the provisioning event a minute to process. Behind the scenes, the Agent signs in to Airbyte and creates the account for you.
3. In Redblock AI Studio, open your deployment's Logs tab. You'll see the SCIM request and the resulting operation, with full execution detail.
4. Confirm the user exists in Airbyte with the expected role.

Common Operations

Troubleshoot

Profile updates from Okta do not appear in Airbyte. Update User Attributes is not supported today: after an account is created, attribute changes pushed from Okta are not applied in Airbyte. Make the change in Airbyte directly; it reflects in Okta on the next import.

Test API Credentials fails. Check three things: the SCIM Base URL on the General tab must end in /scim/v2 (Okta appends resource paths itself), the API Token must be a current Access Key, and the deployment must show Deployed in AI Studio. Keys also expire on the schedule you set; confirm yours is Active on the Access Keys page.

A user provisions in Okta but never appears in Airbyte. Open the deployment's Logs tab in AI Studio. If the SCIM request arrived but the operation failed, the log shows where. A common cause is an Agent identity that has stopped validating; check the Agent's Authentication Status.

401 Unauthorized on SCIM calls. Your Access Key was revoked, expired, or pasted with extra characters. Generate a fresh key in AI Studio, update the Okta API Token, and re-test.

Support

Stuck, or setting up at scale? Write to support@redblock.ai and include your deployment ID (the dep-… value from the Deployments page). Our team can read the deployment's audit trail end to end and pinpoint where a request stopped.