You can provision users and groups from Okta to VMware Workspace ONE® Access™ using the VMware Workspace ONE application that is available in the Okta Integration Network (OIN). The VMware Workspace ONE application uses System for Cross-domain Identity Management (SCIM) provisioning, which is an open standard for automating the exchange of user identity information.

To configure SCIM provisioning from Okta to Workspace ONE Access, you perform prerequisite tasks in Workspace ONE Access first and then configure the VMware Workspace ONE application in Okta.

This diagram shows a high-level overview of the provisioning process:


Overview diagram
  1. Okta is configured to use the VMware Workspace ONE provisioning application.
  2. Okta provisions the user to Workspace ONE Access using SCIM.
  3. The AirWatch Provisioning adapter in Workspace ONE Access provisions the user to VMware Workspace ONE® UEM, if Workspace ONE UEM is part of your Workspace ONE-Okta integration.
Note: This document only covers SCIM user provisioning from Okta to Workspace ONE Access. If you are also using Workspace ONE UEM and want to provision users from Workspace ONE Access to Workspace ONE UEM, see Configuring AirWatch Provisioning App in VMware Workspace ONE Access.

Supported Features

The VMware Workspace ONE application in the Okta Integration Network supports the following features:

  • Create users
  • Update user attributes
  • Deactivate users
  • Create groups
  • Add or remove group members
Note:

Using the same Okta group for assignments and for group push is not currently supported. To maintain consistent group membership between Okta and Workspace ONE Access, you must create a separate group that is configured to push groups to Workspace ONE Access.

Requirements

  • A Workspace ONE Access SaaS tenant
  • An Okta tenant
  • (Optional) Workspace ONE UEM SaaS tenant or version 19.09 for dedicated or on premise
  • Download and install the Postman app.

About This Document

Follow the procedures in the order in which they are listed in this document. Before you configure the VMware Workspace ONE application in the Okta Admin console, you must perform the following prerequisite tasks in Workspace ONE Access:

  • Create a Remote Application Access Client.
  • Generate an OAuth bearer token (requires Postman).
  • Create a directory of type Other (requires Postman).

Related Documentation