> ## Documentation Index
> Fetch the complete documentation index at: https://developers.pleo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta

Pleo supports provisioning users through SCIM with Okta. Managing users through SCIM guarantees security and access control by automating user provisioning and de-provisioning.

There is a known issue with 3rd party systems that trigger provisioning actions in Okta, causing the integration to disconnect. See [limitations](#limitations) for more information.

## Supported features

SCIM provisioning through a supported integration with IDPs, HR systems, or a custom integration through the API support the following operations:

* **Create Users**: Creates or links a user in Pleo when assigning the app to a user in Okta. The default `userName` used to create accounts is set to `Email`. A link is created instead of creating a new User if a Pleo User already exist with `userName` as their email.
* **Update the`userName` of a user**: See [limitations](#limitations) for more information on this flow. Updates to other fields are not supported.
* **Deactivate Users**: Deactivates a user's Pleo account when it is unassigned in Okta or their Okta account is deactivated. Accounts can be reactivated if the app is reassigned to a user in Okta.

*Deactivated users are deleted within two weeks from when they were deactivated unless they are reactivated.*

## Requirements

To be able to manage user access to Pleo through the Okta SCIM integrations, you need to be on the right subscription plan.

<Callout>
  ### 🏳 User Provisioning through SCIM is available on the [Advanced plan](https://www.pleo.io/en/pricing).
</Callout>

**Note:**

<Callout>
  ### 📨 Users added through SCIM are billable as soon as they accept an invite and sign in for the first time. The cost of new accounts will be prorated for the remainder of your current billing period.
</Callout>

## Configuration steps

Follow the steps below to enable SCIM user provisioning through Okta.

### Step 1

Enable provisioning through SCIM in the General settings tab.

<img align="center" alt="Screenshot showing how to enable the API integration with Pleo" border={false} src="https://mintcdn.com/pleo-61d4d38b/T_0d8igGi7akHHm6/images/docs/okta/a1dc59f-Screenshot_2024-05-06_at_4.40.53_PM.png?fit=max&auto=format&n=T_0d8igGi7akHHm6&q=85&s=34d86136031116ad2c4eb9ac5da09901" width="1376" height="698" data-path="images/docs/okta/a1dc59f-Screenshot_2024-05-06_at_4.40.53_PM.png" />

### Step 2

Select **Email** for the **Application username** format on the Sign On application tab in Okta.

<img align="center" alt="Select Okta Sign On Application username" border={false} caption="Select Okta Sign On Application username" src="https://mintcdn.com/pleo-61d4d38b/T_0d8igGi7akHHm6/images/docs/okta/a3de9d8-okta-application-username-step.png?fit=max&auto=format&n=T_0d8igGi7akHHm6&q=85&s=a46076ae06d2c84f76358ebf80fbcd67" width="1152" height="1644" data-path="images/docs/okta/a3de9d8-okta-application-username-step.png" />

### Step 3

Enable the following operations in the Provisioning tab:

* Create Users
* Update User Attributes
* Deactivate Users

<img align="center" border={false} src="https://mintcdn.com/pleo-61d4d38b/T_0d8igGi7akHHm6/images/docs/okta/a306570-okta-step3.png?fit=max&auto=format&n=T_0d8igGi7akHHm6&q=85&s=0236d61736a394d8f0f0aafb2a1d9de4" width="1664" height="1558" data-path="images/docs/okta/a306570-okta-step3.png" />

### Step 4

After assigning Users to Pleo, they still have to be invited for them to start spending.
When the users have been synced into Pleo, you can invite them to use Pleo:

1. Go to **People**
2. Click **Add people**
3. Select the **Users you want to invite to Pleo**

* For multi-entity set-up: Select the entity you want to add the user to
* Select the Card access,
* **Card** - User will only be able to spend with their Pleo card
* **Card and Reimbursement** - User can use their Pleo card and add out-of-pocket expenses
* **Reimbursements only** - User can only add out-of-pocket expenses

Once you have invited the users, they will receive an email invitation that they need to accept.

More information can be found in the [User Management help article](https://help.pleo.io/en/support/solutions/articles/103000287979-user-management-through-your-hr-system) .

## Limitations

* When performing an `userName` update, the email of the user in Pleo will not updated until the email is verified. This requires the user to click the verify link in the email sent to the new email address.
* Simultaneous Provisioning Actions being triggered in Okta can cause the integration to stop working (for example, an HRIS system sending multiple de-provisioning requests to Okta at midnight). This will result in an "API not working" error in Okta and requires the integration to be re-authenticated (see [Configuration Step 1](#step-1)).
* Currently we do not support Import Feature.

If you run into any issues, please [contact us](mailto:team-manage-entities@pleo.io).