How to Set Up Okta SCIM Provisioning for Lucid (2026)

title: How to Set Up Okta SCIM Provisioning for Lucid (2026) slug: how-to-set-up-okta-scim-provisioning-for-lucid excerpt: Automate Lucid user and team provisioning from Okta. Cut manual seat and team assignments in half with SCIM. Full step-by-step guide. post_type: how-to

Lead

When Okta SCIM provisioning is enabled for Lucid, new employees automatically receive Lucid seats and team access the moment they're assigned to the right Okta group. Offboarding is equally smooth: deactivate the Okta account, and Lucid removes access immediately.

Quick answer:

• Generate a SCIM API key in Lucid's admin console
• Paste the key and base URL into Okta's Provisioning tab
• Enable Create Users, Update User Attributes, and Deactivate Users
• Map Okta groups to Lucid teams or roles

Verified against:** Okta Classic Engine and Lucid Enterprise tier on 2026-05-04.

Prerequisites

How ScaleIT handles this: See how compliance works

• Okta Lifecycle Management licensed. Your Okta plan must include the Lifecycle Management add-on (not included in identity-only SKUs). Confirm with your Okta admin.
• Lucid Enterprise plan. Provisioning is available only on Enterprise tier. Team and Business plans do not expose SCIM endpoints.
• Lucid admin or account owner access. You must be able to access the admin console at lucid.app/users/admin and generate API keys.
• Okta admin access. You need to modify the Lucid app integration in Okta's Applications section.
• The Lucid app already installed in Okta. Search the Okta Integration Network (OIN) for "Lucid" and add it (SSO-only installs are fine; you'll enable provisioning in the same tile).

Steps

Step 1: Generate the SCIM API Key in Lucid

1. Sign in to Lucid as an account admin at lucid.app/users/admin.
2. Go to → Admin → App Integration → SCIM Provisioning.
3. Click → Generate API Key.
4. Copy the bearer token that appears. Lucid shows it only once; if you miss it, you'll need to revoke and regenerate.
5. Note the SCIM base URL: https://users.lucid.app/scim/v2 (this is the same for all Lucid accounts).
6. Keep both values handy for the next step.

Step 2: Enable API Integration in Okta

1. In the Okta Admin Console, go to → Applications → Applications (or find the Lucid app tile if you've already added it).
2. Click → Lucid to open the integration.
3. Go to the → Provisioning tab.
4. Click → Configure API Integration.
5. Check → Enable API integration.
6. Paste the Lucid bearer token into the API Token field.
7. The SCIM 2.0 Base URL should auto-populate to https://users.lucid.app/scim/v2. If not, paste it manually (no trailing slash).
8. Click → Test API Credentials. Okta will verify the connection.
9. Click → Save.

Step 3: Enable Provisioning Actions

1. Still on the Provisioning tab, go to → To App in the Settings section.
2. Click → Edit.
3. Check the following:

• Create Users
• Update User Attributes
• Deactivate Users
• Leave Sync Password unchecked (Lucid uses Okta SSO, not local passwords)

1. Click → Save.

Step 4: Configure Attribute Mappings (Optional)

1. On the Provisioning tab, go to → Attribute Mappings.
2. Review the defaults. Okta should map:

• userName → Okta username (email)
• givenName → first name
• familyName → last name

1. If you want to push role or team assignments from Okta, add a custom mapping for Lucid's role attribute to an Okta profile field (e.g., custom attribute for "admin" or "member"). This is optional and allows you to manage role from Okta.
2. Click → Save when done.

Step 5: Push Groups to Lucid Teams

1. On the Provisioning tab, go to → Push Groups.
2. For each Okta group that should map to a Lucid team or role (e.g., Engineering, Product, Marketing):

• Click → Push Groups.
• Search for and select the group.
• Okta will create matching groups in Lucid on first sync.

1. Once groups exist in Lucid, log in to Lucid and go to → Admin → Users and Teams to assign those groups to folders and shared spaces.

Step 6: Test and Assign Users

1. Go to the → Assignments tab on the Lucid app in Okta.
2. Click → Assign and add a test user or test group.
3. Wait a few seconds for the provisioning job to run. You can monitor it on the Provisioning tab under Provisioning Log.
4. Log in to Lucid as a non-admin user and verify they appear in the account and are assigned to the expected teams.

Verify

• Assigned user appears in Lucid. Check Lucid → Admin → Users and Teams and confirm the test user is listed and able to log in.
• Team assignments sync. Verify the user is in the expected team(s) based on Okta group membership.
• Deactivation works. Deactivate the test user in Okta and confirm they lose Lucid access within a few minutes.
• No provisioning errors. Check the Provisioning tab → Provisioning Log in Okta. It should show successful Create and Update events.

Troubleshooting

Symptom: "Error authenticating" when configuring API integration

Cause: The bearer token is invalid or expired, or SCIM is not enabled on the Lucid account.

Fix: Generate a fresh API key in Lucid's admin console (the old one may have been revoked). Confirm that your Lucid account is Enterprise tier and SCIM is available in the admin panel.

Symptom: User is provisioned but doesn't appear in the expected Lucid team

Cause: The group assignment is correct, but the Okta group hasn't been pushed to Lucid, or the push didn't sync.

Fix: Go to Provisioning → Push Groups in the Lucid app tile. Manually push the group again. Then check the Provisioning Log to confirm the group creation succeeded.

Symptom: Changes to user attributes in Okta don't update in Lucid

Cause: Update User Attributes is not enabled, or the attribute mapping is missing.

Fix: Go to Provisioning → To App and confirm Update User Attributes is checked. If it is, check Attribute Mappings and add any missing fields you want to sync (e.g., email, first name).

Symptom: User's documents and team ownerships are lost after deactivation

Cause: This is expected behavior. Lucid's SCIM deactivation is a soft action,it revokes access but preserves ownership and content.

Fix: If you need to fully remove the user and reassign content, do that manually in Lucid's admin console after SCIM deactivation runs.

Symptom: "SCIM base URL" field rejects the URL with a 404 error

Cause: The URL has a trailing slash, or you've added /scim/v2 manually (Okta appends this automatically).

Fix: Use the exact URL: https://users.lucid.app/scim/v2 with no trailing slash and no additional path.

CTA

Setting up SCIM for even one app frees up hours per month on manual seat management. If you're managing multiple apps across Okta and want a clean sequencing plan, or if you hit a snag with provisioning attributes, that's work our team handles regularly. Reach out for a quick conversation about your setup.