This guide shows you how to connect Okta to EdgeTier so that Okta manages your EdgeTier users. Once it is set up, you add, change and remove people in Okta, and EdgeTier follows automatically.

The connection works in one direction only: from Okta to EdgeTier. EdgeTier never changes anything in Okta.

The guide has two parts:

• Part 1: Provisioning users from Okta to EdgeTier. Okta creates each person in EdgeTier with the right role, keeps their details up to date, and deactivates them when they leave. Every workspace needs Part 1.
• Part 2: Assigning Agent Groups through Okta. Okta places people into your EdgeTier Agent Groups, for example a team or a location. If your workspace uses Agent Groups, complete Part 2 after Part 1 is set up. Part 2 only works for people who are already assigned to the application through Part 1.

Before you begin

What EdgeTier sends you

Your Customer Success Manager sends you the following before you start.

https://watchtower.edgetier.com/api/scim/v2 | | API token | The key that lets Okta make changes in your EdgeTier workspace. There is one token per EdgeTier workspace. Keep it private. | | Confirmation that single sign-on is enabled | People created by Okta sign in to EdgeTier through your single sign-on. EdgeTier must turn this on for your workspace before you start.

This is configured separately, please see Single Sign On: Okta SAML Integration. | | EdgeTier Roles | For user role selection we advise setting role strings in a format that contains a role UUID during user mapping. An EdgeTier representative can give you a list of roles set in your workspace. | | Confirmation that agent email addresses match (Part 2: Agent Groups only) | EdgeTier checks that the agents already in your workspace carry the same email addresses as your Okta users, so nobody is duplicated after you complete Part 2: Agent Groups assignment. |

What you need on your side

• An Okta administrator account that can add SCIM Applications and manage groups
• An EdgeTier login that can manage users and roles, and, for Part 2, Agent Groups (the Manage Agent Groups permission). Your EdgeTier Customer Success representative can help set this up with the person from your side.

One workspace, one Okta application

One Okta Application connects to exactly one EdgeTier workspace. Each application gets its own SCIM API token from EdgeTier. A single EdgeTier SCIM API token cannot be shared between EdgeTier workspaces.

Some organisations have more than one EdgeTier workspace, for example one per subsidiary or brand, each with its own sign-in domain. If that is you, connect each workspace separately. Repeat this guide once per workspace, with a new Okta Application and that workspace's own API token.

How it works

Once the connection is set up, Okta does four things in EdgeTier:

1. Creates users. When you add a person to the Application in Okta, Okta creates them in EdgeTier with the role you chose.
2. Updates users. When you change a person's name, email address or role in Okta, Okta updates them in EdgeTier.
3. Deactivates users. When you remove a person from the Application in Okta, Okta deactivates them in EdgeTier. They can no longer sign in.