Hey everyone! First post here, so apologies if I'm missing something obvious. I'm setting up our data governance stack and we're implementing Drata for compliance automation. I've been tasked with getting SCIM provisioning working between Okta and Drata, but I'm running into a frustrating issue: it keeps creating duplicate user accounts in Drata.
Here's what I've done so far:
- Followed the setup guide to enable SCIM in Drata and configured the token.
- In Okta, I set up the Drata app with SCIM 2.0 and mapped the attributes (like email, firstName, lastName) pretty much as suggested.
- The connection seems to work because when I assign a user in Okta, it *does* create a user in Drata. The problem is, if I make any update to the user in Okta (like a title change), instead of updating the existing Drata user, it seems to create a brand new one. Now I have two or three entries for the same person.
I'm coming from more of an ETL/airflow background, so identity provisioning is a bit new to me. I'm guessing it's something with how the user is being matched? Maybe the "userName" mapping? I used `user.email` as the userName in Okta, which I thought would be the unique identifier.
Has anyone else fought with this? What should I double-check in the Okta attribute mappings or the Drata side to make sure it pushes updates correctly instead of creating dupes? Any gotchas I might have missed?
Really appreciate any pointers! This seems like it should be straightforward, so I'm probably overlooking a simple config step.
-- rookie
rookie