--- title: "Configure SAML 2.0 and SCIM with Okta" slug: "configure-saml-2-0-using-okta" status: "update" updated: 2026-09-04T16:34:14Z published: 2026-09-04T16:34:14Z canonical: "help.quickbase.com/configure-saml-2-0-using-okta" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.quickbase.com/llms.txt > Use this file to discover all available pages before exploring further. # Configure SAML 2.0 and SCIM with Okta Use this article to configure SAML 2.0 single sign-on (SSO) and SCIM provisioning between Okta and your Quickbase realm. ## Configure SAML 2.0 with Okta ### Requirements Before you begin: - You must be a Realm Admin - Your realm must be on a Quickbase Business or Enterprise plan ### Supported features The Okta/Quickbase SAML integration currently supports: - SP-initiated SSO - IdP-initiated SSO - JIT (Just-In-Time) Provisioning ### Configure the Quickbase integration 1. As an Okta Administrator, navigate to **Applications** and select **Browse App Catalog**. 2. Search for Quickbase and select **Add**. 3. On General Settings: - Enter an application label. - Enter your realm name as the subdomain. - Select **Next**. 4. On the Sign-On Options tab, select **SAML 2.0**. 5. To get a unique identifier for your Name ID / External Auth ID, configure the username format to **user.getInternalProperty("id")**. 6. Scroll down and select **Done**. 7. On the Sign-On tab: - Navigate to the Metadata URL. - Save the XML as an `.xml` file. - Copy the Sign-on URL. - Download the signing certificate. 8. In your Quickbase Admin Console, navigate to the SAML Authentication tab and select **Configure SAML**. 9. Complete the configuration: - Upload the metadata file. - Upload the signing certificate. - Paste the Sign-on URL. - Optional: Enter a support page URL for your internal help page. - For Entity ID, enter your realm's fully qualified domain name (FQDN). - Leave Provider name unchanged. 10. Select **Submit**. > [!WARNING] > Important > > The email addresses for your users must match in both Quickbase and Okta. If you have questions about this configuration, contact Quickbase Technical Support. ## Configure SCIM with Okta ## Requirements Before you begin: - You must be a Realm Admin - Your realm must be on a Quickbase Business or Enterprise plan - Complete the SAML 2.0 configuration by following [Configure SAML 2.0 with Okta](/v1/docs/configure-saml-2-0-using-okta#configure-saml-20-with-okta) - [Create a user token](/v1/docs/create-and-use-user-tokens#create-and-assign-a-user-token) for a realm admin (it’s not necessary to assign it to an app) ### Supported features - **Create new users**—New users created through Okta are also created in your Quickbase account/realm. - **Update user attributes**—Updates made to the user's attributes through Okta are pushed to your Quickbase account/realm. - **Deny access**—Denying a user in Okta removes their access to your Quickbase realm. - **Restore access**—Restoring a user in Okta restores their access to your Quickbase realm. - **Create groups**—New groups created and pushed through Okta are also created in your Quickbase account/realm. - **Add users to groups**—Users added to the pushed group through Okta are also added to the group in your Quickbase account/realm. - **Remove users from groups**—Users removed from the group through Okta are also removed from the group in your Quickbase account/realm. - **Delete groups**—Groups deleted through Okta are removed from your Quickbase account/realm. - **Update group name**—Updates made to the pushed group name through Okta are pushed to your Quickbase account/realm. - **Push groups**—Push groups created in Okta pushes the group and all of its members to your Quickbase account/realm. ### Configure SCIM Provisioning 1. After you complete the Quickbase integration, open the Provisioning tab. 2. Select **Enable API Integration**. 3. Paste the realm administrator's user token. 4. Select **Test API Credentials**. 5. After the test succeeds, select **Save**. 6. Open the To App tab and enable: - Create Users - Update User Attributes - Deactivate Users 7. Select **Save**. ## Add users to your application With SAML 2.0 and SCIM configured, you can add users to your Okta application using these methods: - Add each user individually - Add users through groups All added users are provisioned in Quickbase and can sign into Quickbase using SSO. Groups assigned through Okta are pushed to Quickbase and appear on the Groups tab in the Admin Console as managed by Okta. ### Assign users individually 1. On the Assignments tab, select **Assign**. 2. Select **Assign to People**. ### Assign users through groups 1. On the Assignments tab, select **Assign.** 2. Select **Assign to Groups**. ## User removal and deprovisioning with Okta Quickbase supports user deprovisioning through SCIM for Okta. When a user is deactivated or removed in Okta, SCIM automatically removes that user's access to your Quickbase realm. > [!WARNING] > Important > > If SCIM is enabled, deprovisioning/denial must be managed in Okta. Removing SCIM-provisioned users directly in the Quickbase Admin Console is disabled to ensure Okta remains the single source of truth. ## Restrictions - The maximum length for user first name, last name, email, and username is 255 characters. - Spaces are not allowed in username and email values. - When pushing a group, Quickbase does not support linking existing groups that were created in Quickbase to groups that were created in Okta. When requesting *Refresh App Groups* in Okta, Quickbase returns the groups that were provisioned in Okta, but excludes any groups that were created in Quickbase. As a result, the Quickbase groups are not listed in Link Group. - When using *Push Now* to resynchronize a group, any Quickbase users (users who were added to the group in Quickbase) are not affected in the Quickbase group. Okta manages only users who were provisioned through Okta. - Importing users and groups from Quickbase to Okta is not recommended. ## Troubleshoot To troubleshoot errors with provisioning, read [Troubleshooting IdM provisioning](https://help.quickbase.com/docs/troubleshooting-idm-provisioning) in the Quickbase API Guide. If you still need help, contact Quickbase Technical Support.