SCIM provisioning enables your team to automatically sync users and groups between Okta and Wistia. With SCIM provisioning enabled, you can create, update, and manage users and groups—no need to manually edit roles on both platforms
Note
SSO/SCIM is available on Enterprise and Premium accounts.
Requirements
Before you configure SCIM provisioning with Okta, make sure you have the following in place:
A Wistia plan that includes SSO/SCIM. If you're not sure whether your plan includes SSO/SCIM, check your plan settings or contact your account manager.
Account Owner access in Wistia. Only Account Owners can enable SCIM provisioning and generate a SCIM API token.
Admin access in Okta. You'll need permissions to add applications, configure provisioning, and edit the Profile Editor in your Okta org.
An existing Wistia app in Okta, configured for SSO. SCIM provisioning is configured on the same Okta app used for Wistia SSO. If you haven't set up SSO yet, complete the Wistia SSO Setup - Okta guide first, then return here.
Supported features
Push New Users: Users created or assigned in Okta are provisioned in Wistia.
Push Profile Updates: Profile changes made in Okta are synced to Wistia.
User Deactivation: Deactivating a user in Okta also deactivates them in Wistia.
Reactivate Users: Users can be reactivated from Okta.
Push Groups: Okta groups are created as contact groups in Wistia; adding or removing members in Okta is reflected in Wistia.
Delete Groups: Groups removed in Okta are removed from Wistia.
Note
Account Owners cannot be provisioned via SCIM
Configuring SCIM provisioning
Enable in Wistia
Note
You must be an Account Owner to configure SCIM provisioning.
In your Wistia account settings, navigate to the SSO tab and toggle SCIM provisioning on. Copy the Base URL and API Token, as you will need them to configure Okta.
Alert
Only one SCIM token can be active at a time. Generating a new token will immediately invalidate the previous one. You must update your Okta configuration when a new token is generated.
Choose a default role to be assigned to users provisioned via SCIM:
Viewer
Limited User
Standard User (selected by default)
Manager
The selected role applies to any user not assigned a specific role in Okta.
You can also designate a content owner for deprovisioned users’ My Library content, if applicable.
Configure the Wistia app in Okta
Once you've enabled SCIM in Wistia, head to your Okta admin dashboard to complete the setup.
Step 1: Find the Wistia app in Okta
If you already have a Wistia SSO app in Okta, skip to Step 2.
If you don't have a Wistia app yet:
In the Okta Admin Console, navigate to Applications → Applications.
Click "Browse App Catalog".
Search for Wistia.
Click the Wistia tile, then click "Add Integration".
Complete the general settings. Enter your Base URL here if required, then click "Done".
For SSO setup steps, follow the Wistia SSO Setup - Okta guide before continuing.
Step 2: Enable SCIM provisioning on the Wistia app
In the Okta Admin Console, navigate to Applications → Applications.
Open the Wistia app.
In the General tab, click "Edit".
Select "Enable SCIM provisioning" as the provisioning option.
Click "Save".
A new Provisioning tab will appear at the top of the app page.
Step 3: Configure the SCIM connection (Integration tab)
This is where you connect Okta to your Wistia account using the API token you generated in Wistia.
Navigate to the Provisioning tab.
In the left sidebar, select Integration.
Click "Configure API Integration".
Check "Enable API integration".
In the API Token field, paste the API token you copied from Wistia's SCIM settings.
Click "Test API Credentials". A success confirmation appears if everything is set up correctly.
Click "Save".
Step 4: Verify provisioning actions (To App tab)
Confirm which actions Okta can perform in Wistia.
In the Provisioning tab, select "To App" in the left sidebar.
By default, the following actions are enabled. If they aren't, click "Edit" and enable them:
Create Users: Allows Okta to provision new users in Wistia when they're assigned to the app.
Update User Attributes: Allows Okta to push profile changes to Wistia.
Deactivate Users: Allows Okta to deactivate users in Wistia when they're unassigned or deactivated in Okta.
Click "Save" if you made any changes.
Assign users to the Wistia app
Once provisioning is configured, assign users so they can be provisioned to Wistia.
Open the Assignments tab.
Click "Assign", then choose "Assign to People" or "Assign to Groups".
Find the user or group you want to assign and click "Assign".
Review the user's profile attributes and set a Wistia role if desired (see Role mapping in Okta below).
Click "Save and Go Back", then "Done".
Assigned users will be provisioned to Wistia immediately. You can verify provisioning by checking the user list in your Wistia account settings.
Existing users
Enabling SCIM alone will not automatically link existing Wistia users to Okta. You must push or assign users from Okta to the Wistia app to establish a connection. Okta will then match users by email; existing users with a match will be linked to SCIM, and their role will update to whatever is set in Okta (either via role mapping or the account default).
Sync user groups
There are two ways to sync Okta groups to Wistia: Assign Groups and Push Groups.
Assign Groups
Use Assign Groups to provision users from an Okta group into Wistia without creating a contact group in Wistia.
When a group is assigned to the Wistia app in Okta, all members of that group are pushed to Wistia as individual users. The group itself does not appear as a contact group in Wistia—only the users are created.
Assign Groups is also the recommended approach for role-based groups (e.g., "Wistia Managers"). Use the Group Role field to assign a Wistia role to all group members.
Push Groups
Use Push Groups to create a contact group in Wistia that mirrors an Okta group and keeps membership in sync.
When a group is pushed from Okta, Wistia creates a new contact group with the same name and adds the existing members to it. Adding or removing members in Okta will update the group in Wistia accordingly.
Note
Wistia does not support linking Okta groups to existing Wistia groups. When a group is pushed, Okta will always attempt to create a new group in Wistia using the Okta group's name. If a group with that name already exists in Wistia, it may create a duplicate.
Role mapping in Okta
The Role and Group Role fields can be used to assign Wistia roles within Okta. The following roles can be configured via SCIM:
Viewer
Limited User
Standard User
Manager
Use the Role field to assign a role to an individual user. Use the Group Role field to assign a role to all group members.
If no role is set in Okta, users will receive the default role configured in Wistia's SCIM settings.
Note
Account Owners cannot be provisioned via Okta.
Tip
If you want to manage roles by group, consider creating dedicated Okta groups for each Wistia role (e.g., "Wistia Managers," "Wistia Standard Users," "Wistia Limited Users," "Wistia Viewers") and use the Group Role field to assign the role to each.
Deactivate SCIM-provisioned users
When a user is deactivated through Okta, their Wistia account is deactivated, and any of their content stored in My Library is preserved and reassigned to the user indicated in the Wistia SCIM settings.
If the designated user is unavailable or inactive, the content will be assigned to the oldest Account Owner.
Troubleshooting
Users stopped syncing from Okta
If changes in Okta stop showing up in Wistia, the problem is usually the SCIM API token.
In your Wistia account settings, go to the "SSO" tab and copy the current API Token.
In the Okta Admin Console, open the Wistia app and click the "Provisioning" tab.
Select "Integration" in the left sidebar, then click "Edit."
Paste the token into the "API Token" field and click "Test API Credentials."
Click "Save," then retry any failed provisioning tasks in Okta.
Note
Only one SCIM token can be active at a time. Generating a new token in Wistia immediately invalidates the old one, so Okta stops syncing until you add the new token.
A user has the wrong role
If Okta sends a role Wistia doesn't recognize, Wistia quietly assigns the default role from your SCIM settings. Okta doesn't show an error. To fix it:
Make sure the Role or Group Role field in Okta is set to one of these exact values:
managerstandard_userlimited_userviewer
Use lowercase and underscores. Values like "Standard User" or "Admin" fall back to the default role
Check which default role you've set under "Role for provisioned users" on the "SSO" tab in Wistia.
Make role changes in Okta, not in Wistia. Okta is the source of truth for SCIM-provisioned users.
A user invited in Wistia isn't linked to Okta
A user invited by hand in Wistia may not be connected to Okta. When that happens, updates and deactivations from Okta never reach their Wistia account. To link them:
In Wistia, remove the user from your account.
In the Okta Admin Console, open the Wistia app and click the "Assignments" tab.
Unassign the user from the Wistia app.
Assign the user again. Okta creates a linked user in Wistia with the role set in Okta.
Tip
Once SCIM is on, add new users through Okta instead of inviting them from Wistia, so they're linked from the start.
Okta shows "Account owners cannot be managed via SCIM"
This error appears when an Okta user's email matches the Wistia Account Owner. SCIM can't create, update, or deactivate the Account Owner, so manage that user directly in Wistia.
Okta shows "A user with the same email already exists"
This means the Wistia user is already linked to a different SCIM identity, for example, because the user was deleted and re-created in Okta. To fix it, remove the user in Wistia, then unassign and reassign them in Okta.
FAQ
Can I use my existing Wistia API token for SCIM?
No. SCIM requires a dedicated token generated from the SCIM settings page. Standard API tokens will not work.
What happens if a user's profile is edited in Wistia after being SCIM-provisioned?
Any edits made in Wistia will be overwritten the next time Okta triggers a sync, as Okta is the source of truth for SCIM-provisioned users.
What happens if I generate a new SCIM token?
The previous token will be immediately invalidated. You will need to update the token in your Okta configuration to restore the integration.
Can I convert an existing Wistia group to a SCIM-managed group?
No. Push Groups always create a new group in Wistia, and existing Wistia groups cannot be converted to or linked with SCIM-managed groups. If you want a SCIM-managed version of an existing group, you'll need to set it up as a Push Group in Okta and manage it from there going forward.
What happens if I change the default role in Wistia after users have already been provisioned?
The updated default role will apply to all SCIM-provisioned users who don't have an explicit role set via Okta attribute mapping, not just new users. Their roles will update the next time Okta runs a sync.