Okta SCIM Provisioning
Configure SCIM (System for Cross-domain Identity Management) standard for your team or district using Okta.
Features
Who can use this feature?
SCIM is only available to Canva Enterprise and Canva for Districts, and it isn’t available for new Canva Teams subscribers.
Limitations: For teams within an organization's structure (both single-team or multi-team), user provisioning and deprovisioning are supported. However, all other functionalities, such as provisioning users directly into specific teams or creating groups, aren’t currently supported.
The following provisioning features are supported:
- Create users - Users in Okta assigned to the Canva App are added as team members of the organization in Canva.
- Update user attributes - Updates made to the user's profile through Okta will be pushed to Canva.
- Deactivate users - Deactivating the user through Okta will lock the user in Canva.
- Import users - Users created in Canva can be provisioned into Okta and matched against existing Okta users or created as new Okta users.
- Create groups - Groups created in Okta can also be created in Canva as a Group under the Canva brand.
- Update group - Updates made to the group’s profile or membership change through Okta will be pushed to Canva.
Before we start
To complete the steps below, SCIM provisioning must be enabled for the Canva application you’ve set up. Please ask Okta to enable this for you.
Configuring SCIM Provisioning in Okta
- Open the Canva app you’ve set up in Okta.
- Go to the General tab and select SCIM under the Provisioning section. This will reveal the Provisioning tab.
- Go to the Provisioning tab and select Integration from the side menu.
- Select Configure API Integration.
- On the API token field, enter the access token from Canva in Step 1 of SCIM Provisioning.
- To check if your access token is correctly configured, click on Test API Credentials. If it is, you should see the success message “Canva was verified successfully!”.
Canva to Okta
- Under the Provisioning tab, click on To Okta from the side menu. Double-check that the settings look like below.
- To change your settings, click on Edit.
Attribute Mappings supported by Canva to Okta provisioning:
Okta Attribute | Value | Apply on |
|---|---|---|
Usernamelogin | Configured in Sign On settings | |
First namefirstName | appuser.givenName | Create |
Last namelastName | appuser.familyName | Create |
Primary emailemail | appuser.email | Create |
Okta to Canva
- Under the Provisioning tab, click on To App from the side menu. Double-check that the settings look like below.
- To change your settings, click on Edit.
Attribute Mappings supported by Okta to Canva provisioning:
Okta Attribute | Value | Apply on |
|---|---|---|
UsernameuserName | Configured in Sign On settings | |
Given namegivenName | user.firstName | Create/Update |
Family namefamilyName | user.lastName | Create/Update |
Primary emailemail | user.email | Create/Update |
Primary email typeemailType | (user.email != null && user.email != '') ? 'work' : '' | Create/Update |
Display namedisplayName | (user.displayName != null && user.displayName != '')? user.displayName : user.firstName + ' ' + user.lastName | Create/Update |
Role role | Expected values (will default to member otherwise): | Create/Update |
Canva Teams Template-designer - Designer in Canva Canva Education DistrictTeacher - Designer in Canva | ||
Note: We do not support Admin roles. By default, they will be given a Designer role. |
Pushing groups
If Push Groups has been enabled, the Push Groups tab should appear. This can be used to provision groups (and their users) from Okta into Canva.
Known issue
When I reactivate a group, some or all of my group members is removed
To resync the group members, click on the Push Status dropdown, then select Push now.
userName cannot be updated via the edit button
Currently, Canva doesn’t support updating the userName attribute via the edit button in the People section.
To update the userName attribute, you can follow these steps:
- Go to Directory > People.
- Click the user you want to update.
- Click on the Profile tab, then click on the Edit button in the Attributes section.
- Update the userName attribute. This should also update the nameId field in the Canva app.
Troubleshooting and Tips
Logs
The View Logs page can be useful for viewing what SCIM actions are being run.
If you’re having trouble configuring your Canva/Okta SCIM integration, contact our Support team for help.
For Canva Education, please reach out to your contact person at Canva for help.
For advanced users, please see our developer documentation on the SCIM endpoint for more information.
Was this helpful?
Helpful
Unhelpful