Netskope Help

User and User Groups Provisioning with Okta

Netskope SCIM app allows you to easily provision users and user groups using Okta. Netskope supports the following provisioning features:

  • Push New Users and User Groups

    When a user or user group is created in Okta or a new user or user group is created in AD and uploaded to Okta, the user is automatically provisioned in the Netskope tenant.

  • Push User Deactivation

    When a user existing in Okta and provisioned in the Netskope tenant is deactivated by Okta, the user is deactivated in Netskope tenant as well.

  • Reactivate user

    A user in the Netskope tenant and identified by the same user-id in Okta or a user that was created and provisioned in the Netskope tenant by Okta is activated, the user is reactivated in Netskope tenant.

Note

  • Netskope supports only SCIM 2.0 protocol

  • After a user is provisioned, any changes (edits) made to the users' username and email-address will not be reflected in the tenant.

  • Ensure that you have provisioned all users before pushing the respective user group.

This document provides details and instructions on how you can quickly integrate with Okta to provision users in Netskope cloud. To integrate Okta to the Netskope cloud, you will need:

  • An admin account with access to the Okta admin console.

  • Create a SCIM 2.0 app in the Okta admin console

  • Configure Netskope SCIM app with sign-on and user-attribute options

  • Assign users to the Netskope SCIM app.

Prerequisites
  • Okta admin account with console access.

  • SCIM Server URL and OAuth Token: This is required to establish connection between your Okta account and Netskope cloud.

    Items

    How to Get them

    SCIM Server URL

    1. Login to your Netskope cloud account and go to Settings > Tools > Directory Tools.

    2. In the Directory Tools page, select SCIM Integration tab to get the SCIM Server URL.

    scim-url.png

    OAuth Token

    1. Login to your Netskope cloud account and go to Settings > Tools > Directory Tools.

    2. In the Directory Tools page, select SCIM Integration tab to create OAUTH tokens for all your vendors.

      Note

      While it is possible to use a single token with all vendors, we recommend that you create individual tokens per vendor.

    3. Click the Add Token button and enter a name to identify the token in the pop-up box. Then click the SAVE button to generate a token.

      oauth-token-2.png
    4. The generated token is listed as shown below.

      oauth-token-3.png
    5. To copy the token into the clipboard, click on the token string and then in the pop-up box, double click on the token.

      oauth-token-copy.png

To watch a video about Okta user provisioning, click play:

 
Creating Netskope App in Okta

The first step towards integrating Okta with Netskope is to create and configure Netskope app as a SCIM application in the Okta account.

  1. Login to your Okta account admin console.

    01-okta.jpg
  2. In the admin console, select Applications and click the Add application button.

    03-okta-appln-02.jpg
  3. Now, search for Netskope in the search box and click Add to select Netskope

    04-okta-appln-03.jpg
Configuring Netskope SCIM App
  1. In the app’s General Settings page, give a name to the app, and specify the sub-domain of your company's tenant URL and click Next to continue.

    05-okta-appln-04.jpg
  2. In the Sign-on options page, select Secure Web Authentication and then select User sets username and password. In the same page, select Application username format as Okta Username and enable Password reveal option.

    06-okta-appln-05.jpg
  3. In the Provisioning tab of the App settings, click the Configure API Integration button.

    scim-provision-01.png
  4. Enter the SCIM URL and the OAUTH Tokens (refer to the steps defined at the beginning of this doc for details) and click the Test API Credentials button to verify connection between Okta and Netskope Cloud.

    scim-provision-02.png
  5. Click SAVE after the API credentials are verified and proceed to configure user attributes in the provisioning tab.

  6. In the Provisioning tab, select To App from the left-hand-side options, and click Edit button for Provisioning to App. Enable the following:

    1. Create Users

    2. Update User Attributes

    3. Deactivate Users

    scim-provision-03.png
  7. Click SAVE.

Add / Assign User and User Group to the Netskope App
  1. In the Assignments tab, click Assign and select Assign to People.

    scim-provision-04.png
  2. Select the user to be assigned and click the Assign button.

    13-okta-appln-12.jpg
  3. To push groups, click the Push Groups tab.

    1. Click Find Groups by Name button.

      push-group-1.jpg
    2. Search for the group to be added to the app and click the SAVE button

      push-group-2.jpg

      Note

      Ensure that all users of the group are already added to the app.

    3. Once added successfully, the user group will display Active status.

      push-group-3a.jpg
Verification

To verify if the users are provisioned in Netskope cloud from Okta, do the following:

  1. Login to your Netskope cloud account.

  2. Go to Settings > Active Platform > Users to view the list of users assigned to the Netskope SCIM app.

    verify-users.png