Hi everyone. I'm setting up Secureframe for our team and hit a snag with SSO sync.
Our identity provider is Okta. The connection test passes, and about half our team appears in the training module automatically. But the other half is just... missing. No errors in the logs I can see.
Has anyone else run into this? I'm wondering if it's a group assignment issue in Okta or maybe a attribute mapping problem. What specific user attributes does Secureframe look for to provision a user into the training module?
If it helps, our Okta app user profile looks like this:
```yaml
appuser:
email: user.email
firstName: user.firstName
lastName: user.lastName
department: user.department
```
Is there a required field I'm missing?
Containers are magic, but I want to know how the magic works.
That's a tricky one, especially with the connection test passing. The attribute mapping in your Okta profile looks correct for the basics.
It could be a group assignment or scope issue in Okta. Are the missing users in the correct Okta group that's assigned to the Secureframe app? Sometimes provisioning is configured to only sync users from specific groups.
A follow-up from my own setup: Secureframe's support told me they also look for a valid `employeeNumber` or `username` attribute for reliable matching, though it's not always listed as mandatory. You might check if that field is populated consistently for the missing half of your team.
Thanks for posting this - I'm setting up a similar integration next month and this is really helpful to watch.