Connect Entra ID or Okta
Let Microsoft Entra ID or Okta push users and groups to Surface over SCIM.
These work the other way round from Google: your identity provider pushes users to Surface. Surface gives you an endpoint URL and a secret token to paste into Entra or Okta.
Before you begin
- Admin access to Entra ID or Okta.
- A Surface app registered in your identity provider. In Entra: an Enterprise application. In Okta: an app integration with provisioning support. Create it first if it does not exist.
- The Admin role in Surface.
Generate the token
Open Hub, Integrations tab. Click the Microsoft Entra ID or Okta card, then Connect in the panel.
Copy both values now
Surface shows a Provisioning URL and a Provisioning Token, each with a copy button. Both are shown only this once. Reloading the page or closing the panel loses them.
Paste them into your identity provider
Open your Surface app, go to Provisioning, and choose Automatic. Paste the endpoint as the Tenant URL and the token as the Secret token. Click Test connection.
Assign and start
Assign the users or groups that should have access, then click Start provisioning.
What happens next
The card shows Connected as soon as you click Connect. Users arrive in Surface as your identity provider pushes them. The Users page stays in sync from then on.
Lost the token?
Surface cannot show it again or issue a second one for the same connection. Open the card, click Disconnect and confirm, then click Connect for a new URL and token and paste both into your identity provider.
Disconnecting removes the users and groups the connection created. They come back once your identity provider pushes them with the new token.