Okta

1. Enable SCIM authorization source in Strata Cloud Manager.

   This step configures Strata Cloud Manager to accept identity and access management changes through a SCIM provider. After enabling SCIM, all user provisioning and role assignments must be performed through the connected SCIM provider.

   1. Use one of the various ways to access Common Services > Identity & Access.
   2. Select Identity & AccessAccess Management.

   3. Click Change Authorization Source.

   4. Enable SCIM and then click Save to apply your changes.

      After SCIM integration is enabled, all access management changes are permitted only through the configured third-party identity provider using the SCIM protocol.
2. Create a service account in Strata Cloud Manager.

   Create a service account that provides the OAuth 2.0 credentials Okta uses to authenticate with the Strata Cloud Manager SCIM endpoint. The service account must have the IAM Administrator role to perform SCIM operations.

   1. Create a Service Account with the IAM Administrator role inside the TSG.

   2. Record the Client ID and Client Secret.

      You need these credentials when configuring the SCIM connection in Okta.

      The Client Secret is shown only once during creation. Store it securely. The service account is used solely for API authentication — users cannot log in to Strata Cloud Manager with these credentials.
3. Create and configure an Okta application.

   Create a Secure Web Authentication (SWA) application in Okta and enable SCIM provisioning for it. This application serves as the integration point between Okta and the Strata Cloud Manager SCIM endpoint.

   1. Log in to the Okta Admin Console.
   2. Select ApplicationsApplicationsCreate App Integration.

   3. Choose SWA - Secure Web Authentication as the sign-in method and click Next.

   4. Configure the application settings:

      • App Name — Specify an application name (for example, SCM SCIM Integration).
      • App's login page URL — Specify any URL in the application URL field.

      The application URL is not used for SCIM provisioning. SCIM is an API-based integration, not a UI integration. You can enter any valid URL string.
   5. Enable SCIM provisioning.

      In the application General tab, click Edit in the app settings. Enable SCIM provisioning, and click Save.

      After saving, a Provisioning tab appears in the application settings.
4. Configure the SCIM connection in Okta.

   Configure the SCIM connector settings and authenticate using the OAuth 2.0 credentials from the Strata Cloud Manager service account.

   1. In the application, select ProvisioningEdit.
   2. Configure the SCIM connection settings:

      • SCIM connector base URL — Enter the base URL of the SCIM endpoint that Okta uses to provision users and groups to your application. Set the value to https://api.sase.paloaltonetworks.com/iam/v1/scim.
      • Unique identifier field for users — Specify the SCIM user attribute that uniquely identifies each user. Set this value to userName.
      • Supported provisioning actions — Select Import New Users, Push New Users, Push Profile Updates, Push Groups, and Import Groups.
      • Authentication Mode — Select OAuth 2 (Client Credentials) to authenticate Okta with the SCIM server using the OAuth 2.0 Client Credentials grant.

   3. Configure the OAuth 2.0 authentication settings:

      • Access token endpoint — Specify the OAuth 2.0 token endpoint that Okta uses to obtain an access token. Set this value to https://auth.apps.paloaltonetworks.com/am/oauth2/access_token.
      • Client ID — Specify the Client ID generated for the service account that you created in Step 2.
      • Client Secret — Specify the Client Secret generated for the service account that you created in Step 2.

   4. Authenticate with Strata Cloud Manager to verify that Okta can authenticate and connect to the SCIM endpoint.

      A success message confirms that the OAuth 2.0 authentication and SCIM endpoint connectivity are working correctly.
   5. Under ProvisioningTo App, click Edit and enable Create Users, then click Save.

      You must enable Create Users to avoid provisioning errors when pushing groups that contain users not yet provisioned in Strata Cloud Manager.
5. Provision groups from Okta to Strata Cloud Manager.

   Import existing Strata Cloud Manager roles into Okta, create an Okta user group, and push the group to Strata Cloud Manager by linking it to a predefined Strata Cloud Manager role.

   1. In the application, select ImportImport Now to retrieve the predefined access policies (roles) from Strata Cloud Manager into Okta.

      You must import groups from Strata Cloud Manager before assigning or pushing any groups. Importing retrieves the predefined Strata Cloud Manager roles so they are available for linking in the Push Groups step.
   2. Create an Okta group.

      Navigate to DirectoryGroups and click Add Group. Enter a group name and click Save. Select the newly added group and add the users you want to provision to this group.

   3. Assign the group to the application.

      In the application Assignments tab, click AssignAssign to Groups. Search for and select the group you created, then click Save and Go Back > Done.
   4. Push the group to Strata Cloud Manager.

      Select the Push Groups tab and click Push GroupsFind groups by name. Search for the Okta group you created. Click the drop-down arrow next to Create Group and select Link Group. From the list of imported Strata Cloud Manager roles, choose the target role you want to map this Okta group to. Click Save.

      Always select Link Group instead of Create Group during push group configuration. Selecting Create Group causes recurring synchronization errors because Strata Cloud Manager does not support group creation through SCIM — only linking to existing predefined roles.
   5. Verify that the push group status shows Active.

      An Active status confirms that Okta successfully linked the group and is synchronizing membership with Strata Cloud Manager.
6. Verify user and group provisioning.

   Confirm that users and groups provisioned through Okta appear correctly in Strata Cloud Manager with the expected role assignments.

   1. Log in to Strata Cloud Manager.
   2. Select SettingsIdentity & AccessAccess Management.
   3. Search for the users provisioned from Okta and verify that they appear with the correct role assignments.

      Identity and access changes may take a few minutes to propagate. If provisioned users don't appear immediately, wait and refresh the page.
7. Add users to a provisioned group.

   Add new users to an Okta group that is already linked and pushed to Strata Cloud Manager. Users added to a linked group are automatically provisioned to the corresponding Strata Cloud Manager role without any additional push action.

   1. In the Okta Admin Console, navigate to DirectoryGroups.
   2. Select the group that is linked to the Strata Cloud Manager role.
   3. Click Assign People.

   4. Search for and select the users you want to add, then click Done.
   5. Navigate to Applications, select your Strata Cloud Manager SCIM application, then select the People tab and verify that the newly added users appear.

   6. Log in to Strata Cloud Manager and navigate to SettingsIdentity & AccessAccess Management.
   7. Verify that the newly added users appear with the expected role assignment.

      Adding users to a linked group automatically synchronizes them to Strata Cloud Manager. You don't need to perform a manual push.
8. Remove users from a provisioned group.

   Remove users from an Okta group that is linked to a Strata Cloud Manager role. Unlike adding users, removing users requires a manual push to synchronize the change to Strata Cloud Manager.

   1. In the Okta Admin Console, navigate to DirectoryGroups.
   2. Select the group that is linked to the Strata Cloud Manager role.
   3. Click the X next to the user you want to remove from the group.

   4. Navigate to Applications, select your Strata Cloud Manager SCIM application, then select the People tab and verify that the user no longer appears.

   5. Select the Push Groups tab.
   6. Click the arrow next to the Active status for the linked group and select Push Now.

   7. Wait for the push group status to return to Active.
   8. Log in to Strata Cloud Manager and navigate to SettingsIdentity & AccessAccess Management.
   9. Verify that the removed user no longer appears in the Strata Cloud Manager tenant.

      Removing a user from the Okta group does not automatically remove them from Strata Cloud Manager. You must manually push the group to synchronize the removal. If you skip the Push Now step, the user retains access in Strata Cloud Manager.
9. Remove and unlink a group from Strata Cloud Manager.

   Remove a group assignment from the Okta application and unlink it from the Strata Cloud Manager role. This process removes all users in the group from the Strata Cloud Manager tenant and disconnects the group mapping.

   1. In the Okta Admin Console, navigate to Applications and select your Strata Cloud Manager SCIM application.
   2. Select the Assignments tab.
   3. Locate the group under Groups and click Remove to unassign the group from the application.

   4. Select the Push Groups tab.
   5. Click the arrow next to the Active status for the group and select Push Now.

   6. Wait for the push to complete and the status to return to Active.
   7. Log in to Strata Cloud Manager, navigate to SettingsIdentity & AccessAccess Management, and verify that the users from the removed group no longer appear.

   8. Return to the Okta application Push Groups tab.
   9. Click the arrow next to the group status and select Unlink pushed group.

   10. When prompted, select Leave the group in the target app and click Unlink.

       Unassigning the group from the application alone does not remove users from Strata Cloud Manager. You must push the change and then unlink the group to fully disconnect the mapping. The Leave the group in the target app option preserves the Strata Cloud Manager role definition while removing the Okta synchronization link.