Skip to content
IT Canvass
Menu
ServiceNow
SailPoint
SAP
TutorialsContact
Integrations · Lesson

Okta integration

Quick answer

Two integrations in one: SSO (users log into ServiceNow via Okta) and lifecycle provisioning (Okta creates/updates/deactivates ServiceNow users via SCIM).

Key takeaways

  • Prerequisites
  • Part A, SSO (SAML 2.0)
  • Part B, Provisioning (SCIM 2.0)
  • Field / attribute mapping
  • Group-driven roles

Two integrations in one: SSO (users log into ServiceNow via Okta) and lifecycle provisioning (Okta creates/updates/deactivates ServiceNow users via SCIM).

Prerequisites

  • ServiceNow: admin, and the Multi-Provider SSO plugin activated.
  • Okta: a Super Admin and the ServiceNow app from the Okta Integration Network (OIN).

Part A, SSO (SAML 2.0)

  • In Okta, add the ServiceNow app (OIN), set your instance subdomain, and choose SAML 2.0.
  • In ServiceNow Multi-Provider SSO → Identity Providers, import Okta's metadata XML.
  • Set the NameID to email/user_name and test with Test Connection before enabling.
  • Activate the IdP and set default; keep a local admin login (/side_door.do) as a fallback.

Part B, Provisioning (SCIM 2.0)

  • In the Okta app, open Provisioning → Integration and enable API integration.
  • Provide the ServiceNow SCIM base URL and a service account credential (or OAuth).
  • Turn on Create Users, Update Attributes, Deactivate Users.

Field / attribute mapping

Okta profile        ServiceNow (sys_user via SCIM)
userName        ->  user_name
email           ->  email
firstName       ->  first_name
lastName        ->  last_name
groups          ->  group membership -> roles

Group-driven roles

  • Push Okta groups to ServiceNow and map them to groups/roles, so access is driven by Okta membership.

Test & go live

  • Assign the app to a test user in Okta; confirm the ServiceNow user is created and can SSO in.
  • Remove the assignment; confirm the user is deactivated.
  • Only then enforce SSO for everyone.

Troubleshooting

  • SAML SSO failed: clock skew or NameID mismatch, check the assertion.
  • Provisioning 401: SCIM service account lacks rights.
  • Locked out: use /side_door.do local login to fix the IdP.
Keep authentication (SSO) and provisioning (SCIM) as two separate, independently testable pieces.

Want to learn this properly?

Our live, instructor-led ServiceNow Training covers this hands-on, with real projects and a certification path.

See the courseAsk a question

Check your understanding

  1. Okta SSO into ServiceNow typically uses what?

    • A. SAML / OIDC
    • B. GlideRecord
    • C. A MID Server
    Show answer

    A. SAML / OIDC

    SAML or OIDC federates login.

  2. What standard is common for user provisioning?

    • A. SCIM
    • B. SOAP only
    • C. FTP
    Show answer

    A. SCIM

    SCIM is the provisioning standard.

Frequently asked questions

What does the term - Okta integration refer to in ServiceNow?

Two integrations in one: SSO (users log into ServiceNow via Okta) and lifecycle provisioning (Okta creates/updates/deactivates ServiceNow users via SCIM).

What is worth remembering about - Okta integration in practice?

ServiceNow: admin, and the Multi-Provider SSO plugin activated. Okta: a Super Admin and the ServiceNow app from the Okta Integration Network (OIN).

What is another point to note about - Okta integration?

In ServiceNow Multi-Provider SSO → Identity Providers, import Okta's metadata XML. Set the NameID to email/user_name and test with Test Connection before enabling.
CallWhatsAppEnquire