Knowledge Base

Okta Integration - SCIM Configuration

Last Modified 2025. szept. 10.

Synchronize users and groups from Okta to TeamViewer with SCIM (System for Cross-domain Identity Management). SCIM helps administrators automatically create, update, deactivate, and manage users in TeamViewer directly from Okta. This article explains how to configure SCIM provisioning using either the TeamViewer application from the Okta Integration Network (OIN) or a custom SCIM application.

This article applies to all TeamViewer Tensor license holders.

Requirements

To use SCIM provisioning, you must meet the following requirements:
A valid TeamViewer Tensor license
TeamViewer Single Sign-On (SSO) configured successfully with Okta
The application's username format is configured as Email, as TeamViewer uses the email address as the SCIM userName attribute
Administrator access to both TeamViewer and Okta

Supported features

TeamViewer supports the following SCIM 2.0 provisioning features:

Create users
Update user attributes
Deactivate users
Sync passwords
Import users
Import profile updates
Push groups and group memberships

Note: Users are never permanently deleted through SCIM. When a user is removed or unassigned, TeamViewer deactivates the account instead of deleting it.

Setting	Value
SCIM connector base URL	https://webapi.teamviewer.com/scim/v2
Unique identifier field	userName (email format)
Authentication	HTTP Header (Bearer Token)

Step 2 – Enabling SCIM provisioning

1. Open your OKTA app.

2. Go to the General tab.

3. Click to Edit the App Settings.

4. Enable SCIM next to the Provisioning section, then click Save.

5. On the Provisioning tab, select Edit, and enter the following information into the fields:

Fields	Information to be entered
SCIM connector base URL	https://webapi.teamviewer.com/scim/v2
Unique identifier field for users	userName

6. Select Push New Users, Push Profile Updates, and Push Groups.

7. Change Authentication Mode to HTTP Header.

8. Enter your SCRIPT Token you created above in the TeamViewer Management Console next to Authorization.

9. Once complete, you can click on Test Connector Configuration, then click Save.

Your completed config should look like this:

10. Edit your Provisioning again and tick the Create Users, Update User Attributes, Deactivate Users, and Sync Password checkbox, then click Save.

Step 4: Add the Customer Identifier SCIM Attribute

After following the steps above, the SCIM parameters must be adapted to include the customer Identifier.

1. Go to Applications.

2. Open the appropriate app.

3. Switch tab to Provisioning, and scroll down to Attribute Mapping.

4. Press Go to Profile Editor.

5. Click on + Add Attribute.

6. Set the following variables where the external name and external namespace must not be changed:

Fields	Information to be entered
Display name	ssoCustomerId
Variable name	ssoCustomerId
External name	ssoCustomerId
External Namespace	urn:ietf:params:scim:schemas:extension:teamviewer:1.0:SsoUser
Attribute length	Greater than 0
Attribute required	Yes
Attribute type	Personal
User permission (Not mandatory but recommended)	Hide

7. Open Mappings for that app.

8. Switch to Okta User to App.

9. Set the customer identifier used also for SSO as a static value.

10. Apply updates now.

11. Under the given Application, click on Provisioning, and the newly created attribute should be visible.

12. Edit the attribute to apply the value only on Create.

Newly provisioned users should now be able to directly log in via their Okta account.

TeamViewer Remote

TeamViewer Tensor

TeamViewer DEX

TeamViewer Frontline