Airtable supports SSO through Okta. This article is intended for administrators who are looking to provision/de-provision users and sync groups via SCIM.
NOTEOkta provisioning is only available for Enterprise-wide License Agreement (ELA) Enterprise plans.
SCIM is a feature only available for users on Airtable Enterprise payment plans. To enable SCIM or inquire about enterprise pricing, have your admin contact Airtable.
Push new users
When you create a new user in Okta, Okta will automatically create an account for that user in Airtable.
Push user deactivation
When you deactivate or disable the user's access to Airtable through Okta, this will also deactivate the user in Airtable.
Deactivating a user in Airtable means logging out all logged-in sessions and greying out the user where they show up in sharing dialogs. The org admin will still be able to log into the user's account by resetting their Okta password. To permanently remove the user's account, the admin must either log into the user’s account and delete it through Airtable's interface (in order to transfer out any bases or workspaces owned by that user), or delete the user through the Enterprise API. We will not charge for deactivated users.
You can reactivate user accounts in Airtable (if they have only been deactivated through Okta, and not manually deleted). Since Airtable uses emailDomains to identify enterprise SLAs, you will only be able to perform actions (i.e. provision/deprovision) on users whose Airtable accounts have the same emailDomain as the admin user's.
This will sync user groups from Airtable to Okta. You can create user groups within the Airtable app using the groups management UI.
This will create an Airtable user group with the same name and membership as the source group from Okta (note that Airtable does not currently support nested groups). Airtable also supports renaming groups, updating group membership, and deleting groups.
Under the Provisioning Tab, click the Configure API integration button.
Next, check the Enable API integration box; then click the Authenticate with Airtable button.
If you are not already signed in to Airtable, you will be redirected to Airtable, where you will need to sign into your Airtable account.
Once you do this, you will then get redirected back to Okta with a message saying you have successfully authenticated.
After you successfully authenticate, two new options will appear under Settings on the left side of your screen—To App and To Okta. Select the To App option, then check the features you want to enable. (In most cases, you'll likely want to enable Create Users and Deactivate Users.) Be sure to click the Save button when you're done.
Once you've gone through these steps, you can provision and deprovision users under the Assignments tab.
If you encounter any issues or need additional assistance, please contact us.