Knowledge Base

Okta Integration - SCIM Configuration

Last Modified: Sep 10, 2025

Synchronize users and groups from Okta to TeamViewer with SCIM (System for Cross-domain Identity Management). SCIM helps administrators automatically create, update, deactivate, and manage users in TeamViewer directly from Okta. This article explains how to configure SCIM provisioning using either the TeamViewer application from the Okta Integration Network (OIN) or a custom SCIM application.

This article applies to all TeamViewer Tensor license holders.

Requirements

To use SCIM provisioning, you must meet the following requirements:
A valid TeamViewer Tensor license
TeamViewer Single Sign-On (SSO) configured successfully with Okta
The application's username format is configured as Email, as TeamViewer uses the email address as the SCIM userName attribute
Administrator access to both TeamViewer and Okta

Supported features

TeamViewer supports the following SCIM 2.0 provisioning features:

Create users
Update user attributes
Deactivate users
Sync passwords
Import users
Import profile updates
Push groups and group memberships

Note: Users are never permanently deleted through SCIM. When a user is removed or unassigned, TeamViewer deactivates the account instead of deleting it.

The Okta Integration Network (OIN) app includes a preconfigured SCIM connector. You only need to provide an API token and enable provisioning features.

Prerequisites

Before configuring SCIM provisioning:

Add the TeamViewer application from the Okta Integration Network (OIN)
Complete the SAML 2.0 SSO setup between TeamViewer and Okta
Generate a script token in TeamViewer

SCIM endpoint configuration

The OIN application already includes the following configuration:

Setting	Value
SCIM connector base URL	https://webapi.teamviewer.com/scim/v2
Unique identifier field	userName (email format)
Authentication	HTTP Header (Bearer Token)

Step 1: Create a script token

Sign in to the TeamViewer web app or desktop client.
Go to Settings > Apps & Tokens.
Select Create app or token.
Select Create script token.

Enter a name and optional description.
Select the required token permissions.

Token permissions

Category	Permissions to enable
User management	create users, edit users, view users
User management (only if you also provision company administrators)	create company administrators, edit company administrators
Group management (required for Group Push)	create groups, edit groups, delete groups, read groups

Click Save.

Open the token menu and select Copy token. We will paste this value into Okta in Step 2

Step 2: Enable API integration (provisioning) in Okta

Open the TeamViewer application in the Okta Admin Console.
Open the Provisioning tab.
Click Configure API Integration.

Enable API Integration.
Paste the script token (generated in step 1) into the API Token field.
Optionally enable Import Groups.
Click Test API Credentials.
Click Save.

Step 3: Enable the provisioning actions

In the Provisioning tab, open To App.
Click Edit.
Enable:
1. Create Users
2. Set password when creating new users
3. Update User Attributes
4. Deactivate Users
Click Save.

Optional:

Open the Import tab.
Run a user import to synchronize existing TeamViewer users.

Step 4: Set the Customer Identifier

Open the Provisioning tab.
Go to TeamViewer Attribute Mappings.
Edit TeamViewer SSO Customer Identifier (ssoCustomerId).
Select Same value for all users.
Enter your SSO Customer Identifier.
Set Apply on to Create and update.
Click Save.

Step 1: Create a script token

Sign in to the TeamViewer web app or desktop client.
Go to Settings > Apps & Tokens.
Select Create app or token.
Select Create script token.

Enter a name and optional description.
Select the required token permissions.

Token permissions

Category	Permissions to enable
User management	create users, edit users, view users
User management (only if you also provision company administrators)	create company administrators, edit company administrators
Group management (required for Group Push)	create groups, edit groups, delete groups, read groups

Click Save.

Open the token menu and select Copy token. We will paste this value into Okta in Step 2

Step 2 – Enabling SCIM provisioning

1. Open your OKTA app.

2. Go to the General tab.

3. Click to Edit the App Settings.

4. Enable SCIM next to the Provisioning section, then click Save.

5. On the Provisioning tab, select Edit, and enter the following information into the fields:

Fields	Information to be entered
SCIM connector base URL	https://webapi.teamviewer.com/scim/v2
Unique identifier field for users	userName

6. Select Push New Users, Push Profile Updates, and Push Groups.

7. Change Authentication Mode to HTTP Header.

8. Enter your SCRIPT Token you created above in the TeamViewer Management Console next to Authorization.

9. Once complete, you can click on Test Connector Configuration, then click Save.

Your completed config should look like this:

10. Edit your Provisioning again and tick the Create Users, Update User Attributes, Deactivate Users, and Sync Password checkbox, then click Save.

Step 3: Enable the provisioning actions

Open the Provisioning tab.
Under To App, click Edit.
Enable:
1. Create Users
2. Update User Attributes
3. Deactivate Users
4. Sync Password
Click Save.

Optional:

Under To Okta, enable:

Import New Users
Import Profile Updates

Step 4: Add the Customer Identifier SCIM Attribute

After following the steps above, the SCIM parameters must be adapted to include the customer Identifier.

1. Go to Applications.

2. Open the appropriate app.

3. Switch tab to Provisioning, and scroll down to Attribute Mapping.

4. Press Go to Profile Editor.

5. Click on + Add Attribute.

6. Set the following variables where the external name and external namespace must not be changed:

Fields	Information to be entered
Display name	ssoCustomerId
Variable name	ssoCustomerId
External name	ssoCustomerId
External Namespace	urn:ietf:params:scim:schemas:extension:teamviewer:1.0:SsoUser
Attribute length	Greater than 0
Attribute required	Yes
Attribute type	Personal
User permission (Not mandatory but recommended)	Hide

7. Open Mappings for that app.

8. Switch to Okta User to App.

9. Set the customer identifier used also for SSO as a static value.

10. Apply updates now.

11. Under the given Application, click on Provisioning, and the newly created attribute should be visible.

12. Edit the attribute to apply the value only on Create.

Newly provisioned users should now be able to directly log in via their Okta account.

Group push

Group push allows administrators to synchronize Okta groups with TeamViewer groups.

How it works

Open the TeamViewer application in Okta.
Go to Push Groups.
Click Push Groups.
Select the groups you want to synchronize.
Complete the push configuration.

Supported operations:

Create groups
Rename groups
Update memberships
Delete groups

Troubleshooting group push

Users must be assigned to the TeamViewer application before group memberships can synchronize
Provision users before or at the same time as group synchronization
Deleting a synchronized group removes only the group and does not deactivate users

Known limitations

Email addresses must be unique across all TeamViewer accounts
Provisioning can fail if the email address already exists in another TeamViewer account
Users are deactivated, not deleted
Reprovisioning a previously deactivated user can fail because the underlying account still exists

Support

If you experience issues with SCIM provisioning, contact TeamViewer Support.

TeamViewer Remote

TeamViewer Tensor

TeamViewer DEX

TeamViewer Frontline

TeamViewer ONE Platform

Knowledge Base

Okta Integration - SCIM Configuration

Requirements

Supported features

Prerequisites

SCIM endpoint configuration

Token permissions

Token permissions

Group push

How it works

Troubleshooting group push

Known limitations

Support