This guide describes how to connect Okta, an identity and access management platform, with Fellow to centralize user authentication and provisioning across your workspace.
What This Integration Provides
Integrating Okta with Fellow enables your organization to:
Authenticate users via SSO: Allow users to sign in to Fellow using their Okta credentials through OpenID Connect (OIDC).
Provision and synchronize users: Manage Fellow user accounts directly from Okta using the SCIM protocol, including automated creating, updating, suspending, and reactivating of users.
Automatically maintain user profiles: Sync profile attributes such as name, manager, and job title from Okta to Fellow, where that information is available.
Once configured, workspace administrators have centralized control over user access, simplifying onboarding and offboarding across the organization.
Requirements
A Fellow account on an Enterprise plan
A Fellow workspace administrator account
An Okta administrator account (or coordination with your IT team)
Integration Components
This integration consists of two independent components, each of which can be configured separately depending on your organization's requirements:
OIDC (SSO) - Enables single sign-on authentication via Okta.
SCIM - Enables automated user provisioning and profile synchronization.
Syncing Teams via Okta Group Push
Okta groups can be synced to Fellow as Teams using Okta's Group Push feature. This must be configured by an Okta administrator or your IT team.
For full instructions, refer to Okta's Group Push documentation.
Group Push Methods
Groups can be pushed to Fellow using one of two methods:
By name: An Okta application administrator manually selects specific groups from Okta to be created and kept in sync in Fellow.
By rule: Groups are pushed automatically based on a matching string in the group name or description, allowing many groups to be pushed at once. Note that group push by rule is not available for Active Directory (AD) integrations.
Known Limitations
Shared groups are not supported. The same Okta group cannot be used for both application assignment and group push. To maintain consistent group membership between Okta and Fellow, create a dedicated group configured solely for group push, separate from any group used for user assignment.