Skip to content
English - United Kingdom
Sign in
  • There are no suggestions because the search field is empty.

How do I set up SCIM provisioning using the Authorisation Code Flow?

SCIM provisioning lets your identity provider automatically create, update, and disable Users and Groups in SpeakUp.

If your identity provider connects to SCIM services through the OAuth 2.0 authorisation code flow (for example, Okta), create an app integration with the "Authorisation Code Flow" authentication method. (See Automated User & Group Management (SCIM) Overview).

SCIM provisioning is one-way, from your identity provider to SpeakUp. Changes made directly in SpeakUp to provisioned Users or Groups can be overwritten by the next sync.

Steps to create the app integration:

  1. Click on the "Settings" icon at the top right corner sienna settings page
  2. Go to "System" on the menu, then "Configuration", and click on "API"
  3. Click on "+ Create app integration" create API
  4. Enter a name for the integration
  5. Set the "Authentication method" to "Authorisation Code Flow (for example, Okta)"
  6. Under "Users and Groups", set the access to "Full access". Full access is required for your identity provider to create, update, and disable Users and manage Groups. With read-only access, it can only retrieve them.
  7. Click on "Add" to create the integrationcreate app int

The integration does not work yet. You first need to configure OAuth in your identity provider and save its redirect URL in SpeakUp, as described below.

Steps to connect your identity provider:

  1. Open the integration you just created. The "OAuth Provisioning Configuration" section shows the Authorization URL, Token URL, Client ID, Client Secret, and ScopeOAuth config
  2. In your identity provider, set up a SCIM provisioning connection with OAuth 2 authentication using these values. As the SCIM base URL, use the address shown under "API Endpoint Configuration"
  3. Copy the redirect URL (also called a callback URL) that your identity provider generates for the connection
  4. Back in SpeakUp, paste it into the "Callback URL" field under "Redirect URL" and click on "Save" callback api
  5. Authorise the connection from your identity provider. When the SpeakUp sign-in window opens, sign in with a SpeakUp account that exists in your environment and has administrator rights 

Your identity provider can now provision Users and Groups into SpeakUp. Newly created Users automatically receive a SpeakUp invitation email.

Never change a User's email address or username from your identity provider's app assignment.

These must be changed in the identity provider's own user directory; changing them through the SCIM connection disables the User in SpeakUp.

See Setting Up Microsoft Entra ID SCIM Provisioning for SpeakUp if your identity provider uses the Client Credential Flow instead.