# Okta

Verkada Command has the ability to integrate with Okta (amongst other Identify Providers \[IdPs]) in 2 capacities, depending on the use case:

* Security Assertion Markup Language (SAML)
* System for Cross-Domain Identity Management (SCIM)

**SAML** handles the authentication process, allowing Okta to be used to manage access to Command, the same as any other Software as a Service (SaaS) application already integrated into your Okta tenant. This means Command can be incorporated into your existing identity framework and be access-controlled based on your current policies in place.

**SCIM** allows you to leverage your existing users and groups already present in Okta and synchronize these with Command. This allows you to retain the current central identity provider, and configure access using your existing users and groups through Command to control access to the platform.

{% hint style="info" %}
Verkada recommends OIDC over SAML for enhanced security and easier configuration. OIDC also enables [Enterprise Controlled Encryption](https://help.verkada.com/command/security/enterprise-controlled-encryption).
{% endhint %}

***

{% tabs %}
{% tab title="OIDC (Recommended)" %}

#### OIDC based SSO for Okta

Verkada Command supports Single Sign-On (SSO) through OpenID Connect (OIDC) with Okta. This integration allows our users to seamlessly and securely authenticate using their existing Okta credentials, streamlining access to Command and enhancing overall security.

{% hint style="danger" %}
OIDC is not supported on Desk Station apps.
{% endhint %}

{% hint style="info" %}
Enable [Enterprise Controlled Encryption (ECE)](https://help.verkada.com/command/security/enterprise-controlled-encryption) for enhanced security.
{% endhint %}

***

**OIDC configuration**

{% stepper %}
{% step %}
**Navigate to your Okta instance to create a new application to manage your OIDC configuration. Click on Applications from the Applications sidebar option and click Create App Integration.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-a7661c159ffd8c01e547a386c419daf0b45f4169%2F32d1945faa32d045eff4cc54bc13a51bfc396018.png?alt=media" alt="" width="563"></div>
{% endstep %}

{% step %}
**Under Create a new app integration, select OIDC - OpenID Connect as your Sign-in method and Single-Page Application as your Application type.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-9298a479f5b6880af9f5247d59587e672b27c7bc%2F32bd7f6a9774fd833bdc00d0079e3e8d46236290.png?alt=media" alt="" width="563"></div>
{% endstep %}

{% step %}
**Under Sign-in redirect URIs give your application an identifiable name and add the following links to the list of Sign-in redirect URIs:**

a. <https://command.verkada.com/oidc/okta/callback>\
b. [http://\<org-short-name>.command.verkada.com/oidc/okta/callback](http://org-short-name.command.verkada.com/oidc/okta/callback) where in the URL is the short-name of your Command organization.

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-92d4440add9b38141e75a60ccc0de92e249dbfee%2F4153edce77be25af05fabe1a42f56bcfc8f613bb.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**(Optional) Under Sign-out redirect URIs add** [**https://command.verkada.com/**](https://command.verkada.com/)**.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-b52f42a2e3c071d0e2d6064d7eea089156f111eb%2F70cbb06d6c88f4ce01f220fdb7289d4c0b40a139.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**Under Assignments, select Skip Group Assignment for now and click Save.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-e48ef12238d62ab065d095e3fe645077d151e999%2F9029377f1bda478375e85b47b64add4b006b18ad.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**Under Assignments, click on the Assign dropdown to assign this application to your (and other relevant) user profiles.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-946a97c621d6629c51432d5de5bb341116b59ef8%2F34cb1cd4d0be5357cc6773055069abd342ad6507.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**Under General, copy the Client ID displayed under Client Credentials.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-615e8090ad56d84854dc095e93a645fcbafec6ee%2F62141b4dc755efd742b9378d37793fafd9de55c0.png?alt=media" alt="" width="800"></div>
{% endstep %}
{% endstepper %}

***

**Command configuration**

{% stepper %}
{% step %}
**In Verkada Command, go to All Products > Admin.**
{% endstep %}

{% step %}
**In the left navigation, select Login & Access.**
{% endstep %}

{% step %}
**Select Single Sign-On Configuration.**
{% endstep %}

{% step %}
**Under OIDC Configuration, click Add New.**

a. Toggle on **Enable.**\
b. (Optional) Toggle on **Require OIDC SSO.**\
c. Under **Select Provider,** select **Okta.**\
d. Under **Add Client and Tenant,** click :plus:.

1. In the **Client ID** field paste the Client ID you copied from Okta.
2. In the **Tenant ID** field enter the first part of your Okta instance's URL. It should look like this: [https://yourinstancename.okta.com](https://yourinstancename.okta.com/).
3. Click **Done**.

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-bf0a84e355696d69603fac6689f9e04c2baf3f31%2F23236b06c048e0f045edeb2f7d44e631cd6dcf2a.png?alt=media" alt="" width="800"></div>

h. **Email Domains,** click :plus:**.**

1. Enter your domain name present (e.g. @verkada.com).
2. Click **Done**.

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-03a2ba25ea251f2a72146ba1464a58bc4e11e7fd%2Ff054308c20f7523b4f1f29da383884cb7c2e6453.png?alt=media" alt="" width="800"></div>

{% endstep %}

{% step %}
**Under Login Test click Run Login Test.**
{% endstep %}

{% step %}
**A successful login test should redirect to the OIDC configuration page. Once you're logged in, add the domain that you need to whitelist.**
{% endstep %}

{% step %}
**Once your domain is added, run the login test again. SSO will not be enabled until this second login test successfully completes.**
{% endstep %}

{% step %}
**Once your domain is verified, you should see it successfully validated.**
{% endstep %}
{% endstepper %}
{% endtab %}

{% tab title="SAML" %}
**Okta SAML Integration**

***

**Before you begin**

For a successful integration, choose the best path for your region:

* [Enable SAML for Your Command Account](https://help.verkada.com/command/security/identity-providers/..#upload-saml-xml-metadata)
* **For US orgs**, you will use an existing Verkada application following steps directly below.
* **For EU and AUS orgs**, follow the steps for the next section to configure a new app integration in Okta.

<details>

<summary>Create a Verkada Okta app (US regions)</summary>

1. **Log in to Okta.**
2. **Go to the Applications page and click Browse App Catalog.**

   <div align="left" data-with-frame="true"><img src="https://downloads.intercomcdn.com/i/o/449896715/390b39e32ff7892e3a4c7123/Screen+Shot+2022-01-17+at+3.17.12+PM.png?expires=1766003400\&#x26;signature=22f123d38bacf85fa5a9f30c9dc7a5242cd3ed61d9a71b44aa24cf937709bb14\&#x26;req=cCQuHsB4moBaFb4f3HP0gK8CSkgsYzn3qhkkLT8eMaCLqqJiY68f8kCdYBCM%0AqY4%3D%0A" alt="" width="800"></div>
3. **In the search bar, type Verkada.**
4. **Click Add Integration.**

   <div align="left" data-with-frame="true"><img src="https://downloads.intercomcdn.com/i/o/449897287/e17bbcb0aac5233606a71783/Screen+Shot+2022-01-17+at+3.18.45+PM.png?expires=1766003400\&#x26;signature=e671263a738671cf7f24df811082e25d8d9fa670f5c9024e9085b5f6e1883fe3\&#x26;req=cCQuHsB5n4lYFb4f3HP0gK4OGuNco5idOO0lt8OafCOqMnOFTJEqxdcz3ZfH%0AOH8%3D%0A" alt="" width="800"></div>
5. **Click Done.**

   <div align="left" data-with-frame="true"><img src="https://downloads.intercomcdn.com/i/o/449897651/d563f47daacb254236cf0454/Screen+Shot+2022-01-17+at+3.21.27+PM.png?expires=1766003400\&#x26;signature=6871448aecf02075e8f29cf2fd6c1f908b7793f1d57c547e7cf0f4efbd479ea3\&#x26;req=cCQuHsB5m4ReFb4f3HP0gGt1PTq1x%2B0JH9fUDuo6%2F3taZSMJf6DmU%2FgeF4xI%0AEkA%3D%0A" alt="" width="800"></div>
6. **In Okta, select the Sign On tab for the Verkada app, and click Edit.**

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-1b411990400f985bbbea74e4ca4d9632f5cd6ff1%2F528acaaf4123dd8ead3b738eecea6a5192c1896f.png?alt=media" alt="" width="800"></div>
7. **Scroll down to Advanced Sign-On Settings and enter the Client ID from your Command account.**

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-74f4293484a71d32b2185c7265e38f1c37e45203%2Fcab4869bcc9e4ccb6bd7cc20ad48af0774f66282.png?alt=media" alt="" width="800"></div>
8. **Select Save.**

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-8b8db3a71413a7f7aeeb7bd67c65c36b8ceb0d76%2F4d52b88b0aaa325eecb346c77acd160de3718e8b.png?alt=media" alt="" width="800"></div>

</details>

<details>

<summary>Configure a new app integration from Okta (EU &#x26; AUS regions)</summary>

1. **Go to Applications, and select Create App Integration.**
2. **Create a new app integration, select SAML 2.0, and click Next.**

   <div align="left" data-with-frame="true"><img src="https://downloads.intercomcdn.com/i/o/1102852007/dd17f8b70d0287d06a11ba40/image.png?expires=1766003400\&#x26;signature=f6e24360efec33ff0e3afa6f07c4c112175037ddb034853b56107bf332cba625\&#x26;req=dSEnFMF7n4FfXvMW1HO4zXPltyd%2B2lhHD1n4y9sXweynIKPYzWTArMzGiQk2%0AxFxH%0A" alt="" width="800"></div>
3. **On the "Create a SAML integration" page, under General Settings, enter an application name, optionally add an application logo, and then click Next.**
4. **In the configure SAML page, fill in the Single Sign-On URL and Audience URI (SP Entity ID) with these links:**

   * For EU orgs: [https://saml.prod2.verkada.com/saml/sso/\<client-ID>](https://saml.prod2.verkada.com/saml/sso/%3Cclient-ID%3E)
   * For AUS orgs: [https://saml.prod-ap-syd.verkada.com/saml/sso/\<client-ID>](https://saml.prod-ap-syd.verkada.com/saml/sso/%3Cclient-ID%3E)

   Check the **Use this for Recipient URL and Destination URL** box.

   <div data-gb-custom-block data-tag="hint" data-style="warning" class="hint hint-warning"><p><strong>Client ID</strong> should be pulled from the Command configuration and replaced in the links inserted in the Okta application.</p></div>

   <div align="left" data-with-frame="true"><figure><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Ffv1e6OUnVHANn4RFdkeq%2Fimage.png?alt=media&#x26;token=64633ce7-dc12-49eb-acc7-8dd3470fccc7" alt="" width="800"><figcaption></figcaption></figure></div>
5. **The application username is the Okta Username.**
6. **Click Next. On the feedback page, check the box labeled "This is an internal app that we have created". Click Finish.**

   <div align="left" data-with-frame="true"><img src="https://downloads.intercomcdn.com/i/o/1102855332/9fae260feef25cb11bd7cd27/image.png?expires=1766003400\&#x26;signature=50ce8e5764340d45248e6c299c221ff32cda6ea62da6428016d113d088f43943\&#x26;req=dSEnFMF7mIJcW%2FMW1HO4zWsfcy8mxJmpu5er%2BtIFWBX5DFNhGgak3xp5mWgs%0A0Rgx%0A" alt="" width="800"></div>
7. **In the attributes statements section, set up attributes mapping as follows:**

   * `email` > `user.email`
   * `firstName` > `user.firstName`
   * `lastName` > `user.lastName`

   <div align="left" data-with-frame="true"><figure><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2FmNBkxcbYKXSHdqFgA4O4%2Fimage.png?alt=media&#x26;token=0536dc1f-b96e-453a-ac3d-b1821dc3c9db" alt="" width="800"><figcaption></figcaption></figure></div>

</details>

***

**Configuration**

{% stepper %}
{% step %}
**In Okta, select the Assignments tab for the app. Click Assign and select People or Groups to enable SSO for these users.**
{% endstep %}

{% step %}
**Select the Sign On tab for the app.**
{% endstep %}

{% step %}
**Scroll down to SAML Signing Certificates and click Generate new certificate if a new certificate does not exist.**
{% endstep %}

{% step %}
**To the right of the certificate, select the Actions dropdown and click View IdP metadata.**

<div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-2420a903551b15e34d1569644982e44f240e4fd2%2F59ebff57b10aaee9573e7c81c7655a6715b7aab4.png?alt=media" alt="" width="800"></div>
{% endstep %}

{% step %}
**Right-click the metadata, select "Save As," and download as an XML file.**
{% endstep %}

{% step %}
**After downloading the XML file,** [**upload it to Command**](https://help.verkada.com/command/security/identity-providers/..#upload-saml-xml-metadata)**.**
{% endstep %}

{% step %}
**In the Verify Metadata section, click Run Login Test.**
{% endstep %}
{% endstepper %}

***

**Troubleshooting**

* **Updating usernames (emails) does not automatically take effect in Command**. If you need to change a username, unassign the user from the SAML app, then re-add the user to the app for the change to take effect.
* **If a new user cannot log in via SSO**, it could be because the email domain is not being added to the SSO configuration in the Verkada backend. If the user's email is outside the email domains configured when SSO was set up, the user cannot use SSO. If this is the cause of the problem, you need to edit the SSO configuration and add this domain to remedy the issue.
* **If you experience any other problems with setting up SSO**, contact [Verkada Support](https://help.verkada.com/command/need-help/contact-verkada-support).
  {% endtab %}

{% tab title="User Provisioning" %}

#### Okta SCIM Integration

***

**Before you begin**

{% stepper %}
{% step %}
**You need an API token to connect to the Verkada SCIM endpoint. This token is unique per the Verkada organization. Learn how to** [**acquire a SCIM API token**](https://help.verkada.com/command/security/identity-providers/scim-token-management)**.**
{% endstep %}

{% step %}
**For a successful integration, choose the best path for your region:**

* **For US orgs**, follow the steps in Create a Verkada Okta app.
* **For EU and AUS orgs**, follow the steps in Enable SCIM provisioning in Okta app.
  {% endstep %}
  {% endstepper %}

{% hint style="warning" %}
To confirm which region you're located, [refer to where your organization was created for Verkada](https://help.verkada.com/command/getting-started/get-started-with-verkada-command).
{% endhint %}

***

**Create a Verkada Okta app**

<details>

<summary>US region</summary>

1. Log in to Okta.
2. On the left navigation panel, click Applications.
3. At the top, click Browse App Catalog.

<div align="left" data-with-frame="true"><img src="https://downloads.intercomcdn.com/i/o/449896715/390b39e32ff7892e3a4c7123/Screen+Shot+2022-01-17+at+3.17.12+PM.png?expires=1766003400&#x26;signature=22f123d38bacf85fa5a9f30c9dc7a5242cd3ed61d9a71b44aa24cf937709bb14&#x26;req=cCQuHsB4moBaFb4f3HP0gK8CSkgsYzn3qhkkLT8eMaCLqqJiY68f8kCdYBCM%0AqY4%3D%0A" alt="" width="800"></div>

4\. In the search bar, type Verkada, click the app, and then click Add Integration.

<div align="left" data-with-frame="true"><img src="https://downloads.intercomcdn.com/i/o/862216187/b148b14a43ce418501b12069/8375910_OktaSCIMintegration.png?expires=1766003400&#x26;signature=2ed4243f90ccb2112842367c8966cd540765dba751717a8f5963079ce366b0fc&#x26;req=fCYlFMh4nIlYFb4f3HP0gBUSQgAMwz4tz0EiSwyS8tw2UQZtrTgdZJv0gOHs%0AYM4%3D%0A" alt="" width="800"></div>

5\. For Application label, type Verkada (or any unique name you prefer) and click Done.

<div align="left" data-with-frame="true"><img src="https://downloads.intercomcdn.com/i/o/449897651/d563f47daacb254236cf0454/Screen+Shot+2022-01-17+at+3.21.27+PM.png?expires=1766003400\&#x26;signature=6871448aecf02075e8f29cf2fd6c1f908b7793f1d57c547e7cf0f4efbd479ea3\&#x26;req=cCQuHsB5m4ReFb4f3HP0gGt1PTq1x%2B0JH9fUDuo6%2F3taZSMJf6DmU%2FgeF4xI%0AEkA%3D%0A" alt="" width="800"></div>

</details>

<details>

<summary>EU &#x26; AUS region</summary>

1. Log in to Okta.
2. Go to the Applications page and click Create App Integration.

   <div align="left" data-with-frame="true"><img src="https://verkada.intercom-attachments-7.com/i/o/886851144/63f1c84c55eb91cd2c8eaa9a/WsSZmmICcArfKIUzbJYN4_T5Sra5e6IO34jeIdFraM2YPNuIIjjJ8Rh1vnOMjVmDq_dGKbLpqX4o_QT0NP6DyPgJhyjHAy2BUydB7V23rMr5xFPmT4icGAsCgohn0m5wTxje0zah2xX4sQ1xtlm25wo?expires=1766003400\&#x26;signature=19aae02631c4e9ad01969e320ce1ad7c0984fcae271d336cd2f177974e686414\&#x26;req=fCghHsx%2FnIVbFb4f3HP0gFX9cCgDlGGbgLvgCfpHtN1iQ4hvq%2F9YOxRafCNG%0ARbA%3D%0A" alt="" width="800"></div>
3. On Create a new app integration, select SAML 2.0 and click Next.
4. In the App name field, enter a name and click Next.
5. On Create SAML Integration:
   1. For Single sign-on URL:

      For EU orgs: [https://saml.prod2.verkada.com/saml/login/\<org short name>](https://saml.prod2.verkada.com/saml/login/) where *\<org short name>* is your organization’s short name.

      For AUS orgs: [https://saml.ap-syd.verkada.com/saml/login/\<org short name> ](https://saml.prod3.verkada.com/saml/login/)where *\<org short name>* is your organization’s short name.
   2. For Audience URI (SP Entity ID):

      For EU orgs:[ https://saml.prod2.verkada.com/saml/sso/\<org short name> ](https://saml.prod2.verkada.com/saml/sso/)where *\<org short name>* is your organization’s short name.

      For AUS orgs: [https://saml.](https://saml.prod3.verkada.com/saml/sso/)[ap-syd](https://saml.prod3.verkada.com/saml/login/)[.verkada.com/saml/sso/\<org short name> ](https://saml.prod3.verkada.com/saml/sso/)where *\<org short name>* is your organization’s short name.
   3. Scroll down and click Next.

      <div align="left" data-with-frame="true"><img src="https://verkada.intercom-attachments-7.com/i/o/886851148/6fd39889aad356e828a9f1e2/c95BQJPAkrZwgMRjzr1FQ1hIT28LoFNI5VMyRfx65HTud87oLHkEbrzq8LPe01MHtA6tKF-sRYv8p0cKUCQkVUThaoJnWGxBHj-Him2q5DmIdm-bQy0dzvQpk0cRvWwRvGf1PTZzGTn79b1zfz_gA98?expires=1766003400\&#x26;signature=5fd20b86013bc0f4ba28cbdd3d233f71a2a6961cec82c73c0b477748fb44a9ef\&#x26;req=fCghHsx%2FnIVXFb4f3HP0gIsENFokZPlQ6p7gfi0ihxbn4uDdLx%2FWBqOO7c3X%0APHg%3D%0A" alt="" width="800"></div>
6. Select the I’m an Okta customer adding an internal app radio button and click Finish (optionally, you can skip Okta’s additional questions).
7. On the left navigation, click Applications and click your newly created app (if you are not automatically redirected to your app).
8. At the top, select the General tab:
   1. At the top right, click Edit for your app’s App Settings.
   2. Check the Enable SCIM provisioning box.
   3. Click Save.

      <div align="left" data-with-frame="true"><img src="https://verkada.intercom-attachments-7.com/i/o/886851153/bfa634bbbaae62cca595a09f/vwlKHLqNXGQkFOWEkVbAKXZhzP-aSETLv4m9IQ3O2gzBpP9Np7ocOAkzAktGxC8wM53R8WR3etrx2fs3zsjCXL20YbqEy7DwD8i48-hxcB3FXdllet8sYm3zUtzgB55G0EUGEW1ji0uXjMIYZyzepjA?expires=1766003400\&#x26;signature=55027176fa5d6a8129c53a97c6743086c488a3e43abc188cf83104121a54e73f\&#x26;req=fCghHsx%2FnIRcFb4f3HP0gFJXoIOCtJbQzP0a%2FnhB2y7JCSg5lWFQzV%2F2FDTF%0Ai%2BI%3D%0A" alt="" width="800"></div>
9. On SCIM Connection:
   1. At the top of your newly created app, select the Provisioning tab.
   2. Click Edit for the SCIM Connection settings.
   3. For SCIM connector base URL

      For EU orgs, <https://scim.prod2.verkada.com/scim>

      For AUS orgs, [https://scim.ap-syd.verkada.com/scim](https://scim.prod2.verkada.com/scim)
   4. For Unique identifier field for users, enter userName.
   5. Check the Push New Users, Push Profile Updates, and Push Groups boxes.
   6. Click the Authentication Mode dropdown and select HTTP Header.
10. Copy and paste the SCIM token from Command in the Authorization field.

    <div align="left" data-with-frame="true"><img src="https://verkada.intercom-attachments-7.com/i/o/886851157/96d872e82636280e8810b5cd/2psAWP661MUUm0bwdb-15pWDM2yInrCLzJ52ju9UQ141G1OuZWQvUCD-MJE3HWMumJyPIyqIxUXUfmJG7JtQ4DaTJ6OkaaThBRqXBDWznAvJ8F-6vRExzhUfbTQVHJ9ySeGsrujuOhPE9kEmMykpFpo?expires=1766003400\&#x26;signature=1a3a6dac2cf88e1fc3668dca25798e5742035c80f146cd21a11274e619978943\&#x26;req=fCghHsx%2FnIRYFb4f3HP0gIT5S38DtHQhhUWTe3Q20l5GdXTLrtOI2YLqFnK0%0ARYY%3D%0A" alt="" width="800"></div>
11. Click Save.

</details>

***

**Configure the Verkada Okta app**

<details>

<summary>US region</summary>

1. Log in to Okta.
2. On the left, click Applications and click the Verkada app.
3. On the left, select the Provisioning tab.
4. Under the Provisioning tab > Integration:
   1. Click Configure API Integration.
   2. Check the Enable API integration box.
   3. In the API Token field, copy and paste your Command-generated API token.
   4. Click Save.

      <div align="left" data-with-frame="true"><img src="https://verkada.intercom-attachments-7.com/i/o/886851164/bfaea19da7bc2d70c8718f59/1Uqq8IPPIlQxHHrtgwQX2uoof53IwL43EqOj6sgOKGkL21FpMDgPKvZU4O3UR8axr9tSc0o-EfGs239SNAEqxzIKwfe8j1N5UXZPHSHo4-fH0O9vh470EhNgw2TU77d72HjC0YEJEFEkQ9gjuJM3JxM?expires=1766003400\&#x26;signature=fec9e530aff69237affe8757ddf306027fbc84c81bc5a234c9c4846d0077cf97\&#x26;req=fCghHsx%2FnIdbFb4f3HP0gOEEIFpHRoy4XZ%2Bzea%2BP76fZ9tG4Lw5cmlHZAO6w%0ASvA%3D%0A" alt="" width="800"></div>
5. Under the Provisioning tab > Settings:
   1. Select To App and click Edit.
   2. Check the Enable box for Create Users, Update User Attributes, and Deactivate Users.
   3. Click Save.

      <div align="left" data-with-frame="true"><img src="https://verkada.intercom-attachments-7.com/i/o/886851172/d574d2353093abe51f46555f/oEFsUMqaaEmJgSbRL43Q-r3TBLlIl1p0E0z_zu8-iNUsfnUUOM4BY2SodL6eCh99zJ6GERBJX7MCbSGsyBHMgvKnmAEaLE_R8KDIj6x1P6eTXrGJPYyALWqsNQ7q5--t4wu6RsmCY6wPsW8mQAV6ees?expires=1766003400\&#x26;signature=fc77bae6b81720fccb8f86f3570051605226a436ed4b940553c8b4046495089f\&#x26;req=fCghHsx%2FnIZdFb4f3HP0gCKBhfXRZqkUtOVsefJPDM96y22ejfZXznC1xdmM%0AdIc%3D%0A" alt="" width="800"></div>
6. Under the Provisioning tab > To App section > Verkada Attribute Mappings, click Go to Profile Editor.
7. Ensure that the attributes match, as shown in example below. You can add more attributes than shown. See [Add attributes to SCIM-managed users](#add-attributes-to-scim-managed-users).

   <div align="left" data-with-frame="true"><img src="https://verkada.intercom-attachments-7.com/i/o/886851176/a0db505658eaae5d0d626de0/PIBYFY8jXzcT7lnRd57pjtfZum9oDzyH5Rx9BiiAKmE6sJflxxQCBQL2HacJRGzZdSH_bIICRVTIt7_BrXbmiJLwyTLxPFAVEtmsQiwPb9qzNrimmTL15XZzwoU2sZivYIIFHNtrvVJDd15Zuff0Oc4?expires=1766003400\&#x26;signature=8b1b23a5e437f5e559e1ae4ed7f555efd35d8fcb36bd832b8a5fcf5c251ed4de\&#x26;req=fCghHsx%2FnIZZFb4f3HP0gGCncM16IH%2BM1u2IZJmbblnERJH2LTdehgXA1xRb%0AF%2Bk%3D%0A" alt="" width="800"></div>

</details>

<details>

<summary>EU and AUS region</summary>

1. Log in to Okta.
2. On the left, click Applications and click the Verkada app.
3. Under the Provisioning tab > Settings:
   1. Select To App and click Edit.
   2. Check the Enable box for Create Users, Update User Attributes, and Deactivate Users.
   3. Click Save. You can add more attributes than shown. See [Add attributes to SCIM-managed users](#add-attributes-to-scim-managed-users).

      <div align="left" data-with-frame="true"><img src="https://verkada.intercom-attachments-7.com/i/o/886851180/11af938596e16a8fd1103eb4/oEFsUMqaaEmJgSbRL43Q-r3TBLlIl1p0E0z_zu8-iNUsfnUUOM4BY2SodL6eCh99zJ6GERBJX7MCbSGsyBHMgvKnmAEaLE_R8KDIj6x1P6eTXrGJPYyALWqsNQ7q5--t4wu6RsmCY6wPsW8mQAV6ees?expires=1766003400\&#x26;signature=874ef3a07ff6a32c3366e9c70f41153d76368b171a44aadf9e006292ab41ab34\&#x26;req=fCghHsx%2FnIlfFb4f3HP0gL%2BQvgs5Jd2oAQ0QnMC3vH91dWpOTKMXuDGqcrvr%0AuSs%3D%0A" alt="" width="800"></div>

</details>

***

**Add-on attributes to SCIM-managed users**

<details>

<summary>Add attributes to SCIM-managed users (optional)</summary>

Verkada and Okta support these attributes: `userName` (default), `givenName` (default), `familyName` (default), `title`, `employeeNumber`, `primaryPhone`, `department`, `organization`.

You can also sync a unique identifier to Command by mapping it to the **externalId** field. This enables advanced use cases such as disambiguating users across systems or syncing access credentials to a unique user reference. This value is stored in the database and can be queried via API, but it does not appear in the Command UI.

{% hint style="info" %}
To provision phone numbers outside the US in Command, include the country code in the user's phone number in the Okta profile.

For example:

* **US:** 123-456-7890 → **+1 123-456-7890**
* **UK:** 07123 456789 → **+44 7123 456789**

Using the international format ensures the number is correctly imported into Command.
{% endhint %}

1. **Log in to Okta.**
2. **Create the Attribute in the SCIM App Profile.**

   1. In Okta, go to **Directory > Profile Editor.**
   2. Select your **Verkada SCIM-managed application User.**
   3. Click **Add Attribute** and add the attribute details as listed in the [table](#attribute-table) below.
   4. Click **Save.**

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-740b098ddce2f7147ea7ea94c0cfa822cb0f805b%2Ffb5e0d1c0264e15722496928034f4ab4cdbe420f.png?alt=media" alt="" width="800"></div>
3. **Map the Attribute**

   1. Still in Profile Editor, click **Mappings.**
   2. Choose **Okta User to \[Your SCIM App].**
   3. Click the dropdown and find the source field you want to map (e.g., user.nickName, employeeNumber, or another custom field) and map it to the `appuser` attribute.
   4. Click the arrow between fields and select **Apply mapping on user create and update.**
   5. Click **Save Mappings.**

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-cff69210a5e6aa2a730195c37890dff948d68ab8%2F7e4c1e21ebef0311b7075553445651c9ebd47f82.png?alt=media" alt="" width="800"></div>
4. **Confirm Attribute is Populated**

   1. Navigate to **Directory > People.**
   2. Open a user profile and ensure the source field you're mapping from (e.g., Nickname) has a value.
   3. From the **SCIM App > Provisioning tab**, use **Force Sync** to push updates if needed.

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-e864e1d84ef75446e8664a70e5b2907a86b9aa2e%2F3137ce3a5868a5c57efc1a69ce61a536c54e1cf2.png?alt=media" alt="" width="800"></div>

{% hint style="warning" %}
Refer to this list of credentials for the list of [acceptable card formats](https://app.gitbook.com/s/aaHs5RfKqv9Z49mi02cC/installation/badge-reader-support/supported-card-formats).
{% endhint %}

</details>

<details>

<summary>Add access credentials to SCIM-managed users (optional)</summary>

1. **Log in to Okta.**
2. **On the left navigation, select Directory > Profile Editor.**
   1. Select **User (default)** as the user type.
   2. Click **Add Attribute** and add the custom attributes from the [table](#attribute-table) below.
3. **On the left navigation, select Applications and open your Verkada SCIM-managed application.**
4. **On the Provisioning tab, select To App > Go to Profile Editor.**
5. **Click Add Attribute to create the attributes listed above using the exact same Data Type, Display Name, Variable Name, Description, and ENUM values.**

   1. Set the **External namespace** value for all attributes to:

   ```
   urn:ietf:params:scim:schemas:extension:verkada:access:2.0:User
   ```

   2. Set **Attribute type** to **Personal**.
   3. Click **Save** to add the attribute.
6. **Click Mappings to map the attributes from the Okta User application to your SCIM application.**

   1. Select **Okta User to YourSCIMApp** at the top and map the custom attributes created for the Okta Default User to the ones created on your SCIM application.
   2. Click **Save Mappings** and **Apply updates now** to apply the changes.

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-13e9a7031c586e27ddd2da4e77ab2419c03ce0f5%2Fef89dd06940b3b805ea16e2556bbd95cffcb834d.png?alt=media" alt="" width="800"></div>
7. **The attributes should now be available to use on all your Okta application's users' profiles.** Once synced, you can view the credentials on Command under Access > Access Users > User Profile > Credentials.

   <div align="left" data-with-frame="true"><img src="https://705858581-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNRq5qDDjsYNxwNzF1bcB%2Fuploads%2Fgit-blob-ac2be2e63c5acadfc907505a67f97c62a3bc4340%2F5b875a8a5fee900ed99ff0b3450bdcc90bb09d1d.png?alt=media" alt="" width="800"></div>

</details>

<details>

<summary>Attribute table</summary>

Refer to this list of credentials for the list of [acceptable card formats](https://app.gitbook.com/s/aaHs5RfKqv9Z49mi02cC/installation/badge-reader-support/supported-card-formats). Data type for all attributes will be string.

|                   |                                                                                            |                                                                |                                                     |                                                                         |
| ----------------- | ------------------------------------------------------------------------------------------ | -------------------------------------------------------------- | --------------------------------------------------- | ----------------------------------------------------------------------- |
| **Display Name**  | **Variable Name /External Name**                                                           | **External Namespace**                                         | **Description**                                     | **ENUM**                                                                |
| Card Format       | cardFormat                                                                                 | urn:ietf:params:scim:schemas:extension:verkada:access:2.0:User | Card format for access credential                   | Leave unchecked                                                         |
| Card Number       | cardNumber                                                                                 | urn:ietf:params:scim:schemas:extension:verkada:access:2.0:User | Card number for access credential                   | Leave unchecked                                                         |
| Card Number Hex   | cardNumberHex                                                                              | urn:ietf:params:scim:schemas:extension:verkada:access:2.0:User | Hexadecimal representation of the card number       | Leave unchecked                                                         |
| Credential Status | credentialStatus                                                                           | urn:ietf:params:scim:schemas:extension:verkada:access:2.0:User | Status of the card credential                       | Checkbox: active → active, deactivated → deactivated, deleted → deleted |
| Facility Code     | facilityCode                                                                               | urn:ietf:params:scim:schemas:extension:verkada:access:2.0:User | Facility code associated with the card              | Leave unchecked                                                         |
| External ID       | externalId                                                                                 | urn:ietf:params:scim:schemas:extension:verkada:core:2.0:User   | Customer-defined unique ID, not exposed in UI       | Leave unchecked                                                         |
| Department ID     | costCenter                                                                                 | urn:ietf:params:scim:schemas:extension:verkada:core:2.0:User   | Identifier used to map user's department in Command | Leave unchecked                                                         |
| Title             | title                                                                                      | urn:ietf:params:scim:schemas:core:2.0:User                     | User's title or role                                | Leave unchecked                                                         |
| Employee Number   | employeeNumber                                                                             | urn:ietf:params:scim:schemas:core:2.0:User                     | Employee ID                                         | Leave unchecked                                                         |
| Phone Number      | <p>Variable Name: phoneNumber<br></p><p>External Name: phoneNumbers\[type==work].value</p> | urn:ietf:params:scim:schemas:core:2.0:User                     | Work phone number                                   | Leave unchecked                                                         |
| Department        | department                                                                                 | urn:ietf:params:scim:schemas:core:2.0:User                     | User's department                                   | Leave unchecked                                                         |
| Organization      | organization                                                                               | urn:ietf:params:scim:schemas:core:2.0:User                     | Company or organization                             | Leave unchecked                                                         |

</details>

***

**Provision users and groups**

{% hint style="warning" %}
Users added to the app push automatically; groups need to be pushed manually.
{% endhint %}

<details>

<summary>Users within Okta</summary>

1. Log in to Okta.
2. On the left, click Applications and click the Verkada app.
3. Click the Assignments tab.
4. Click the Assign dropdown and select Assign to People.
5. Click Assign for the people you want to provision to the app.
6. You'll see the information for that user. At the bottom, click Save and Go Back.
7. When you are redirected to the Assign page, click Done.

</details>

<details>

<summary>Groups within Okta</summary>

1. Log in to Okta.
2. On the left, click Applications and click the Verkada app.
3. Click the Assign dropdown and select Assign to Groups.
4. Click Assign for the groups you want to provision to the app.
5. You'll see the information for that group. At the bottom, click Save and Go Back.
6. When you are redirected to the Assign page, click Done.
7. At the top, select the Push Groups tab.
8. Click the Push Groups dropdown to find groups (by name or by rule).

   <div align="left" data-with-frame="true"><img src="https://downloads.intercomcdn.com/i/o/908982850/0e072e940214abd86eccae78/8375910_PushGroups2.png?expires=1766003400\&#x26;signature=c683ba9a537f5f61a445595354759205f7d05d3a013958409fa33d10e53b025e\&#x26;req=fSAvH8F8lYRfFb4f3HP0gBjiUrIpNNuxqoUP%2FsMKcUgdsP%2FBiZqRIbif1UoG%0Aack%3D%0A" alt="" width="800"></div>
9. Find the group you want to push and click Save. If successful, the Push Status shows Active.

   <div align="left" data-with-frame="true"><img src="https://verkada.intercom-attachments-7.com/i/o/886851187/ff3bcb4859a185c725971d13/XG0rEyG-XDWORuFFC5OnBuAAl8tUCxUnC-Kld0NoCJokuF5TFUGcUzWV_mvhwu8oB1rlI1RCg_RdNfl8d3vp41h2lbLGUnYWZJYhDPsNIx43BK16y4xlZlyyH-CQzJLAIvzS0nQqIeEWrnpXHLYUkO8?expires=1766003400\&#x26;signature=0246e57d8680e08596d6512b14df2c89c13364b4677a8339da387976b1684953\&#x26;req=fCghHsx%2FnIlYFb4f3HP0gFDQ0cgPnnmdT8g7G1F1L2o4ttgtkFgRDHzNIki%2B%0ABaM%3D%0A" alt="" width="800"></div>
10. Command then tags users and groups as SCIM Managed, if they are imported via SCIM.

<div align="left" data-with-frame="true"><img src="https://downloads.intercomcdn.com/i/o/908983529/77b17d99bdb427518624c0dd/8375910_PushGroups.png?expires=1766003400\&#x26;signature=03b70057ea0ac3881d86f24a8181488733242f8779814dd825870515992d05a8\&#x26;req=fSAvH8F9mINWFb4f3HP0gPMJ%2F1wgTqLZsR1nHZfRlffqmSaMW1oNhJjjRzd5%0ARYc%3D%0A" alt="" width="800"></div>

</details>

***

**Delete SCIM-managed users from Command**

When a SCIM-managed user is deactivated in your identity provider, you can remove the user from Command in two ways:

* **Delete the user** – The account moves to the Deleted Users page but keeps historical records, roles, and permissions.
* **Permanently remove the user** – All roles, credentials, access logs, and associated data are erased. If the user is re-provisioned via SCIM, Command creates a new user record.

{% hint style="warning" %}
You must deactivate the user in your identity provider (IdP) before either deletion option is available in Command.
{% endhint %}

***

**Known issues**

* **Updating usernames (emails) does not automatically take effect in Command**. If you need to change a username, unassign the user from the SAML app, then re-add the user to the app for the change to take effect.
* **If a new user cannot log in via SSO**, it could be because the email domain is not being added to the SSO configuration in the Verkada backend. If the user's email is outside of the email domains provided when SSO was set up, this causes the user to be unable to use SSO. If this is the cause of the problem, you need to edit the SSO configuration and add this domain to remedy the issue.
* **If you run into this error while provisioning users,** *"Error while trying to push profile update for user: Bad Request. Errors reported by remote server: Invalid request",* see this [Okta article](https://support.okta.com/help/s/article/verkada-provisioning-error-error-while-trying-to-push-profile-update-for-user-bad-request-errors-reported-by-remote-server-invalid-request?language=en_US) for troubleshooting steps.
* **If you experience any other problems with setting up SSO**, contact [Verkada Support](https://help.verkada.com/command/need-help/contact-verkada-support).

***

{% hint style="info" %}
**Prefer to see it in action?** Check out the [video tutorial](https://www.youtube.com/watch?v=YSMzqFwWlW4).
{% endhint %}
{% endtab %}
{% endtabs %}