~15 minutes
Provision members from Okta into Wando over SCIM 2.0. Okta pushes user lifecycle events (create / update / deactivate) and group assignments to Wando's SCIM endpoint, and Wando maps groups to roles.
In the Okta Admin Console, open Applications → Applications and click the Wando OIDC integration you created in the SSO guide.
Email your Wando contact (hej@wando.app) and ask them to issue a SCIM token for this organisation. They'll send back a bearer string — keep it handy for step 4.
On the Wando app, open the "Provisioning" tab. Click "Configure API Integration" → check "Enable API integration".
Enter the values below and pick "HTTP Header" as the authentication mode. Click "Save".
Click "Test API Credentials". Okta verifies that Wando responds at `/ServiceProviderConfig` with the bearer token. A green check means the connection is good.
Still on the Provisioning tab, select "To App" in the left sub-nav. Click "Edit" and enable: "Create Users", "Update User Attributes", and "Deactivate Users". Save.
Open the "Assignments" tab on the app, click "Assign" → "Assign to People" or "Assign to Groups". Only assigned users will be pushed to Wando.
Open the "Push Groups" tab. Click "Push Groups" → "Find groups by name" and pick the groups you want Wando to see (typically the groups you also want to map to roles). Okta will create them on Wando's side as SCIM groups.
After Okta pushes the groups, send your Wando contact a list of which group should map to which role — "admin", "boss" or "member". They'll apply it. Users in multiple groups get the highest role.
Send your values to your Wando contact
Once Okta has pushed its first provisioning cycle, send your Wando contact the group-to-role mapping you want. They'll apply it to the SCIM groups Okta pushed and confirm when provisioning is live.