---
title: Connect Entra ID or Okta
description: Let Microsoft Entra ID or Okta push users and groups to Surface over SCIM.
---

These work the other way round from Google: your identity provider **pushes** users to Surface. Surface gives you an endpoint URL and a secret token to paste into Entra or Okta.

## Before you begin

- Admin access to Entra ID or Okta.
- A Surface app registered in your identity provider. In Entra: an Enterprise application. In Okta: an app integration with provisioning support. Create it first if it does not exist.
- The Admin role in Surface.

1. **Generate the token**

    Open **Hub**, **Integrations** tab. Click the **Microsoft Entra ID** or **Okta** card, then **Connect** in the panel.

2. **Copy both values now**

    Surface shows a **Provisioning URL** and a **Provisioning Token**, each with a copy button. Both are shown only this once. Reloading the page or closing the panel loses them.

3. **Paste them into your identity provider**

    Open your Surface app, go to **Provisioning**, and choose **Automatic**. Paste the endpoint as the Tenant URL and the token as the Secret token. Click **Test connection**.

4. **Assign and start**

    Assign the users or groups that should have access, then click **Start provisioning**.

## What happens next

The card shows **Connected** as soon as you click Connect. Users arrive in Surface as your identity provider pushes them. The [Users](/surface/environment/users) page stays in sync from then on.

## Lost the token?

Surface cannot show it again or issue a second one for the same connection. Open the card, click **Disconnect** and confirm, then click **Connect** for a new URL and token and paste both into your identity provider.

Disconnecting removes the users and groups the connection created. They come back once your identity provider pushes them with the new token.