If you have a lot of users to manage manually, you can now take advantage of SCIM provisioning in Okta! If you use Okta, follow the instructions below to setup SCIM provisioning so that:

• Users are automatically created in Reachdesk when they are added to a group assigned to the Reachdesk app
  • Users will have a sender role by default, but this can be updated after they are created
• User names and emails are automatically updated in Reachdesk when this changes in Okta
• Users are automatically deactivated in Reachdesk when they are deactivated in Okta
• Teams are automatically created and updated in Reachdesk when they are created updated in Okta (as long as the correct teams are pushed as groups)

 

Please reach out to your IT team to help with this setup in Okta.

 

1. Create SCIM App in Okta

Go to the Applications page and click on "Browse App Catalog"

Then search for "SCIM 2.0 Test App (OAuth Bearer Token)" and select the app

Then click Add Integration.

 

2. Configure the App

Rename the app to Reachdesk and click Next

In the next page, set the following values:

• Login URL: https://app.reachdesk.com/users/saml/auth
• ACS URL: https://app.reachdesk.com/users/saml/auth
• Audience URL: https://app.reachdesk.com/users/saml/metadata

Once updated, click Done to complete the SAML setup

 

3. Create API Token for SCIM

In the Reachdesk platform, go to Organization > Settings > API Tokens and create a new API Token.

Copy the token and go back to Okta to finalize the configuration.

 

4. Setup Provisioning in Okta

In Okta, in the newly created Reachdesk application, open the Provisioning tab and click on Configure API Integration:

Configure the following values:

• SCIM 2.0 Base Url: https://app.reachdesk.com/scim_v2
• OAuth Bearer Token: [paste the newly created token]
• Import Groups: We recommend turning this on so you can import existing teams in Reachdesk as Okta groups.
  • This is important if you are already a Reachdesk customer and you want to import existing Reachdesk teams as Groups in Okta. This way, you can link existing teams to Okta groups.
  • If you want to import new Reachdesk teams created after the setup as Okta groups, simply go back here and click save again.

Then click on Test API Credentials to verify it's working correctly, and then Save. Your application should be now configured to use SCIM for provisioning. 

 

5. Update your Provisioning Settings and Attribute Mappings

Ensure that all provisioning options are enabled as desired (Create/Update/Deactivate) in the Provisioning to App section:

 

Ensure you review all attribute mappings in the Reachdesk Attribute Mappings section. Note that some User and Team fields don't exist in Reachdesk so it will not be synced.

 

6. Setup SAML authentication

You should now follow the steps for configuring the SAML authentication. You will need to download the metadata from Okta and upload it to Reachdesk > Organization > Settings > Single Sign On. You can find the instructions here.

 

7. Configure your Groups in Okta

Groups in Okta will represent the "teams" you have in Reachdesk. 

 

View Groups in Okta

If you followed the instructions in Step 4, you will see existing Reachdesk teams created as "Groups" in Okta if you go to Directory > Groups.

• In this example, you can see three "teams" created in Reachdesk were created as "groups" in Okta. 

Link Okta Groups to Existing Reachdesk Teams

If you had existing Reachdesk teams that you want to link with Okta groups, follow the instructions in the video below.

1. Go to Directory > Groups > Add Group
2. Create a group that has the same name as the Reachdesk team that was synced as a group before
3. When that group is saved, it should have an Okta icon next to it
4. Go to Applications > Assignments
   • Assigning a group allows that group to be provisioned from the Reachdesk app you created in Okta.
5. Click Assign > Assign to Groups
6. Look for the Group you just created. 
7. Now you need to go to the Push Groups tab > Push Groups > Find Groups by Name
   • Pushing a group allows you to either create new teams in Reachdesk, or link Okta groups to existing teams in Reachdesk.
8. Look for the Group you just created. It would say "Match found" if there is an existing Reachdesk team with the same name. 
9. Enable "push group membership immediately" if you want to automatically sync users added to that group to Reachdesk.

10. Click Save.

11. If you click on the Settings icon in the Push Groups tab, you can control this setting that allows you to rename groups. This means when you rename a group in Okta, it will rename the linked team in Reachdesk.

 

Create Okta Groups as a new teams in Reachdesk

You can also create new Okta groups as new teams in Reachdesk.

To add groups in Okta:

1. Go to Directory > Groups
2. Click "Add Group"
3. Add the name of the group and click "Save"

To sync the new Okta group as new teams in Reachdesk, watch the video below or follow the instructions:

1. Go to Applications > Assignments
2. Click Assign > Assign to Groups
3. Look for the Group you just added
4. Click Assign and click Done
5. Go to Push Groups
6. Click Push Groups > Find Groups by Name
7. Look for the Group you just added and select it
8. In the "Match result & push action," section, make sure you select "Create Group"
   • This means the team and the users within it will be created in Reachdesk automatically.
9. Click Save
10. Once the push status is Active, you can go to Reachdesk and see the new team and user(s) within that team created.

FAQs

Can users assigned to multiple groups in Okta be assigned to multiple groups in Reachdesk?

Yes! As long as you've added the user to the correct groups in Okta, and the group is added in the Assignments and Push Groups tabs, the user and their teams should sync automatically with Reachdesk. 

 

What happens if the Okta group is removed from the Assignments tab?

This will deactivate the users within that group in Reachdesk, but the team will remain in Reachdesk.

 

What happens if you "deactivate" a group push in Okta?

This means any new members will not get synced.

What happens if you "unlink a pushed group" in Okta?

If you click "Unlink pushed group" in the Push groups tab, you will have the option to the delete the team in Reachdesk.

You can either delete the Reachdesk team or leave the Reachdesk team.

 

How else can I configure how to sync users and groups in Okta?

There are many different ways you can configure how to sync users and groups in Okta so please work with your IT team to find the best solution for you! If you have any questions, please reach out to your CSM or contact support@reachdesk.com.