SCIM provisioning enables your team to automatically sync users and groups between Okta and Wistia. With SCIM provisioning enabled, you can create, update, and manage users and groups—no need to manually edit roles on both platforms
Note
SSO/SCIM is available on Enterprise and Premium accounts.
Prerequisites
Before you configure SCIM provisioning with Okta, make sure you have the following in place:
A Wistia plan that includes SSO/SCIM. If you're not sure whether your plan includes SSO/SCIM, check your plan settings or contact your account manager.
Account Owner access in Wistia. Only Account Owners can enable SCIM provisioning and generate a SCIM API token.
Admin access in Okta. You'll need permissions to add applications, configure provisioning, and edit the Profile Editor in your Okta org.
An existing Wistia app in Okta, configured for SSO. SCIM provisioning is configured on the same Okta app used for Wistia SSO. If you haven't set up SSO yet, complete the Wistia SSO Setup - Okta guide first, then return here.
Supported Features
Push New Users: Users created or assigned in Okta are provisioned in Wistia.
Push Profile Updates: Profile changes made in Okta are synced to Wistia.
User Deactivation: Deactivating a user in Okta also deactivates them in Wistia.
Reactivate Users: Users can be reactivated from Okta.
Push Groups: Groups from Okta are created as contact groups in Wistia; adding or removing members in Okta is reflected in Wistia.
Delete Groups: Groups removed in Okta are removed from Wistia.
Note
Account Owners cannot be provisioned via SCIM
Configuring SCIM Provisioning
Enable in Wistia
Note
You must be an Account Owner to configure SCIM provisioning.
In your Wistia account settings, navigate to the SSO tab and toggle SCIM provisioning on.
From here, be sure to copy the Base URL and API Token, as you will need these for Configuration in Okta.
Alert
Only one SCIM token can be active at a time. Generating a new token will immediately invalidate the previous one. You must update your Okta configuration when a new token is generated.
Choose a default role to be assigned to users provisioned via SCIM:
Viewer
Limited User
Standard User (selected by default)
Manager
The selected role will be applied to any user who is not assigned a specific role in Okta.
You can also designate a content owner for deprovisioned users’ My Library content, if applicable.
Configure the Wistia app in Okta
Once you've enabled SCIM in Wistia, head to your Okta admin dashboard to complete the setup.
Step 1: Find the Wistia app in Okta
If you already have a Wistia SSO app in Okta, skip to Step 2.
If you don't have a Wistia app yet:
In the Okta Admin Console, navigate to Applications → Applications.
Click Browse App Catalog.
Search for Wistia.
Click the Wistia tile, then click Add Integration.
Complete the general settings. You may be required to enter your Base URL here, then click Done.
For SSO setup steps, follow the Wistia SSO Setup - Okta guide before continuing.
Step 2: Enable SCIM provisioning on the Wistia app
In the Okta Admin Console, navigate to Applications → Applications.
Click the Wistia app.
On the General tab, click Edit.
Select Enable SCIM provisioning as the provisioning option.
Click Save.
A new Provisioning tab will appear at the top of the app page.
Step 3: Configure the SCIM connection (Integration tab)
This is where you connect Okta to your Wistia account using the API token you generated in Wistia.
Click the Provisioning tab.
In the left sidebar, select Integration.
Click Configure API Integration.
Check Enable API integration.
In the API Token field, paste the API token you copied from Wistia's SCIM settings.
Click Test API Credentials. A success confirmation appears if everything is set up correctly.
Click Save.
Step 4: Verify provisioning actions (To App tab)
Confirm which actions Okta is allowed to perform in Wistia.
Still on the Provisioning tab, select To App in the left sidebar.
By default, the following actions are enabled. If they aren't, click Edit and enable them:
Create Users: Allows Okta to provision new users in Wistia when they're assigned to the app.
Update User Attributes: Allows Okta to push profile changes to Wistia.
Deactivate Users: Allows Okta to deactivate users in Wistia when they're unassigned or deactivated in Okta.
Click Save if you made any changes.
Assign users to the Wistia app
Once provisioning is configured, assign users so they can be provisioned to Wistia.
Click the Assignments tab.
Click Assign, then choose Assign to People or Assign to Groups.
Find the user or group you want to assign and click Assign.
Review the user's profile attributes and set a Wistia role if desired (see Role mapping in Okta below).
Click Save and Go Back, then Done.
Assigned users will be provisioned to Wistia immediately. You can verify provisioning by checking the user list in your Wistia account settings.
Existing users
Enabling SCIM alone will not automatically link existing Wistia users to Okta. You must push or assign users from Okta to the Wistia app to establish a connection. Okta will then match users by email; existing users with a match will be linked to SCIM, and their role will update to whatever is set in Okta (either via role mapping or the account default).
Sync user groups
There are two ways to sync Okta groups to Wistia: Assign Groups and Push Groups.
Assign Groups
Use Assign Groups to provision users from an Okta group into Wistia without creating a contact group in Wistia.
When a group is assigned to the Wistia app in Okta, all members of that group are pushed to Wistia as individual users. The group itself does not appear as a contact group in Wistia — only the users are created.
Assign Groups is also the recommended approach for role-based groups (e.g., "Wistia Managers"). Use the Group Role field to assign a Wistia role to all group members.
Push Groups
Use Push Groups to create a contact group in Wistia that mirrors an Okta group and keeps membership in sync.
When a group is pushed from Okta, Wistia creates a new contact group with the same name and adds the group's members to it. Adding or removing members in Okta will update the group in Wistia accordingly.
Note
Wistia does not support linking Okta groups to existing Wistia groups. When a group is pushed, Okta will always attempt to create a new group in Wistia using the Okta group's name. If a group with that name already exists in Wistia, this may result in a duplicate.
Role mapping in Okta
The Role and Group Role fields can be used to assign Wistia roles within Okta. The following roles can be configured via SCIM:
Viewer
Limited User
Standard User
Manager
Use the Role field to assign a role to an individual user. Use the Group Role field to assign a role to all members of a group.
If no role is set in Okta, users will receive the default role configured in Wistia's SCIM settings.
Note
Account Owners cannot be provisioned via Okta.
Tip
If you want to manage roles by group, consider creating dedicated Okta groups for each Wistia role (e.g., "Wistia Managers," "Wistia Standard Users," "Wistia Limited Users," "Wistia Viewers") and use the Group Role field to assign the role to each.
Deactivate SCIM-provisioned users
When a user is deactivated through Okta, their Wistia account is deactivated, and any of their content stored in My Library is preserved and reassigned to the user indicated in the Wistia SCIM settings.
If the designated user is unavailable or inactive, the content will be assigned to the oldest Account Owner.
FAQ
Can I use my existing Wistia API token for SCIM?
No. SCIM requires a dedicated token generated from the SCIM settings page. Standard API tokens will not work.
What happens if a user's profile is edited in Wistia after being SCIM-provisioned?
Any edits made in Wistia will be overwritten the next time Okta triggers a sync, as Okta is the source of truth for SCIM-provisioned users.
What happens if I generate a new SCIM token?
The previous token will be immediately invalidated. You will need to update the token in your Okta configuration to restore the integration.
Can I convert an existing Wistia group to a SCIM-managed group?
No. Push Groups always create a new group in Wistia, and existing Wistia groups cannot be converted to or linked with SCIM-managed groups. If you want a SCIM-managed version of an existing group, you'll need to set it up as a Push Group in Okta and manage it from there going forward.
What happens if I change the default role in Wistia after users have already been provisioned?
The updated default role will apply to all SCIM-provisioned users who don't have an explicit role set via Okta attribute mapping, not just new users going forward. Their roles will update the next time a sync is run in Okta.