Provisioning with Okta

Parzify draws the org chart from the people Okta provisions into it over SCIM 2.0. Assign a group in Okta and its members appear on the chart within seconds, each under the manager Okta names; change a title or a manager in Okta and the chart follows. Setup takes about fifteen minutes.

Sign-in is a separate guide: Single sign-on with Okta. Do that first if you have not yet, so you can sign in to Parzify while you work.

Prerequisites

A Parzify company account and an admin who can sign in at app.parzify.com.
The Parzify app added to your Okta org from the Okta Integration Network (step 1 of the sign-in guide).
An Okta attribute that holds each person's manager, usually the manager's email. Without it people still arrive, but they are listed as unplaced on the chart until a manager is known.

Supported features

Create users: assigned people are created in Parzify.
Update user attributes: name, title, department, manager and the other mapped attributes are kept current.
Deactivate users: people unassigned or deactivated in Okta leave the chart.
Reactivate users: reassigning or reactivating brings them back.

Not supported: group push, import of users from Parzify into Okta, password sync, and profile sourcing (Okta stays the source of truth, Parzify never writes back). Assigning groups to the app works as usual; it is the pushing of group objects into Parzify that is not offered.

Configuration steps

1. Get your company slug and a token from Parzify

Sign in to Parzify as an admin and open Admin › Identity › Provisioning.
Copy the Company slug. It is the last part of the SCIM base URL and tells Okta which company to send people to.
Click Generate token and copy it. It is shown once; generating a new one later replaces the old one.

2. Enable the API integration in Okta

In the Okta Admin Console open the Parzify app, go to the Provisioning tab and click Configure API Integration.
Tick Enable API integration. Enter the company slug in Company slug and paste the token into API Token, then click Test API Credentials. Okta reports that the connection was verified. Save.
The slug is only needed for provisioning. If you use Parzify with single sign-on alone, nothing on this tab needs filling in.

3. Turn on Create, Update and Deactivate

Still on the Provisioning tab, open To App and click Edit.
Tick Enable for Create Users, Update User Attributes and Deactivate Users. Leave Sync Password off. Save.

4. Check the attribute mappings

Scroll to Attribute Mappings on the same page. The Parzify app comes with the mappings below already in place; check them against your Okta profile. The one that matters most is Manager value: it must point at the field where your Okta keeps the manager's email or username (by default managerId), because that is what draws the reporting lines. Click the pencil on a row to change its expression.

Level	Attribute in Okta's table	Value
Required	Username (userName)	`Okta username` Set in the Sign On settings; leave as is. Used to match sign-ins to people.
Required	Given name (givenName)	`user.firstName` First name on the card
Required	Family name (familyName)	`user.lastName` Last name on the card
Recommended	Email (email)	`user.email` Shown in the profile; also how managers are matched
Recommended	Manager value (managerValue)	`user.managerId` The Okta field that holds the manager's email or username. This is what draws the reporting lines. If your company keeps the manager's email in a custom attribute, map that one instead.
Recommended	Manager display name (managerDisplayName)	`user.manager` The manager's name. Used only as a fallback when Manager value is empty or matches nobody.
Recommended	Title (title)	`user.title` Job title under the name on the card
Recommended	Department (department)	`user.department` Colors the cards and drives department pages and filters
Recommended	Division (division)	`user.division` Larger grouping above departments, shown in the profile
Optional	Display name (displayName)	`user.displayName` Accepted for compatibility and not used: the card always shows the first and last name, so a name change in Okta is reflected right away
Optional	Employee number (employeeNumber)	`user.employeeNumber` Shown in the profile
Optional	Organization (organization)	`user.organization` Legal entity or business unit, shown in the profile
Optional	Time zone (timezone)	`user.timezone` IANA name like America/Los_Angeles; shows local time, and places the person on the Geography map when there is no work address
Optional	Locality (locality)	`user.city` City, for the Location filter
Optional	Region (region)	`user.state` State or province; the Geography map breaks the United States down by state (CA or California both work)
Optional	Country (country)	`user.countryCode` Two-letter code like US or DE; places the person on the Geography map ahead of the time zone
Optional	Primary phone (primaryPhone)	`user.primaryPhone or user.mobilePhone` Shown in the profile when the person allows it

5. Assign people

Open the Assignments tab, click Assign › Assign to Groups and pick the group that should appear on the chart (or Everyone for the whole company). Leave the attribute dialog as it is and click Save and Go Back.
Okta pushes the members right away. Back in Parzify, Admin › Identity › Provisioning counts them as they arrive, and the chart is ready as soon as the first manager relationship lands.

Assign the whole company to get a complete chart. A manager who is not assigned is unknown to Parzify, so their reports show under Admin › Data health as unplaced until the manager is assigned too.

Troubleshooting

Test API Credentials fails: the company slug or the token on the Provisioning tab is wrong, or the token was replaced in Parzify. Generate a fresh token and paste it again.
People are assigned but not on the chart: check that the assignment is on the Parzify app with provisioning enabled and Create Users ticked. Admin › Sync log in Parzify shows every request Okta sent and our answer.
Someone shows without a manager: Admin › Data health lists each person we could not place and the manager value Okta sent. Fix the value in Okta, or the Manager value mapping; the chart updates on the next push.
A person left but is still on the chart: they are still assigned to the app in Okta, or Deactivate Users is off.

Still stuck? Email hello@parzify.com with your company name and, for provisioning questions, the Sync log entry.