Enterprise plan only. SCIM user provisioning is available exclusively on the Enterprise tier. If you are on another plan and want to use it, contact us to talk about upgrading.

This guide explains how to connect the Pensero app from the Okta Integration Network (OIN) to your Pensero organization so that users are created, updated and deactivated automatically over SCIM 2.0. Pensero is an AI-native engineering measurement platform: it turns pull requests, tickets and documents into delivery, quality and impact signals per person and team. The Okta integration keeps the people Pensero measures in sync with your directory, so seats, names, managers and access follow your HR and identity processes instead of being maintained by hand. For an overview of what SCIM does in Pensero, see User provisioning with SCIM. Not using Okta? See Set up SCIM with a different identity provider.

Prerequisites

Your Pensero organization is on the Enterprise plan and user provisioning is enabled for it. If you do not see Organization Settings → User provisioning, contact [email protected].
You are an organization administrator in Pensero.
You are an administrator of your Okta org.
Every user you plan to assign has a corporate email address in Okta. Pensero identifies people by email, so the SCIM userName must be the user's email.
Your Pensero organization has enough active seats for the users you plan to assign (see How to add and manage seats).
Optional: single sign-on. Pensero supports SAML 2.0 SSO with Okta as well as Google and Microsoft sign-in. SCIM works with any of them; if you also want SAML SSO, contact [email protected] to exchange metadata.

Supported features

The Pensero OIN app supports the following provisioning features:

Create Users — a user assigned to the app in Okta is created in Pensero. If a Pensero user with the same email already exists, Okta links to it instead of creating a duplicate.
Update User Attributes — profile changes in Okta (name, manager, Git usernames, level, start date, login access and more) are pushed to Pensero.
Deactivate Users — unassigning the app, deactivating or deleting the user in Okta deactivates the user in Pensero, frees their seat and ends their reporting lines. Historical data is kept; nothing is deleted. Reactivating in Okta reactivates the user in Pensero.
Import New Users (from Pensero to Okta) — Okta can import existing Pensero users and match them to Okta users by email.
Import Profile Updates (from Pensero to Okta) — Okta can read the current Pensero profile of an already linked user.

Not supported:

Push Groups / group provisioning. Pensero has no Groups endpoint; teams are managed in Pensero.
Sync Password. Pensero has no passwords; users sign in with SSO.
Changing an existing user's email. A changed userName is stored as the user's username; the Pensero email is kept.

Configuration steps

Step 1: Generate a SCIM token in Pensero

Go to Organization Settings → User provisioning.
Click Generate token.
Copy the full token string (in the form token:secret) and store it somewhere safe. It is shown unmasked only once; you can copy it again later from the same page while it is active.

Step 2: Add the Pensero app in Okta

In the Okta Admin Console go to Applications → Applications → Browse App Catalog.
Search for Pensero and click Add Integration.
Keep the default application label (or rename it) and click Done.
Open the Sign On tab, click Edit under Settings and set Application username format to Email. Pensero uses the user's email as the SCIM userName, so this setting is required. Save.

Step 3: Enable SCIM provisioning

Open the Provisioning tab and click Configure API Integration.
Tick Enable API integration and paste the full token:secret string from Step 1 into API Token.
Click Test API Credentials. Okta confirms the connection to https://pensero.ai/api/scim/v2. Save.
Go to Provisioning → To App → Edit, enable Create Users, Update User Attributes and Deactivate Users, and save.

Step 4: Map attributes

Okta sends the standard user attributes (userName, first name, last name, email) automatically. To send Pensero-specific data such as Git usernames, manager, level or login access, map the Pensero attributes in the app profile. The full list, with types and accepted values, is in the SCIM attribute reference.

In Provisioning → To App, scroll to Attribute Mappings and click Show Unmapped Attributes. The Pensero attributes (external namespace urn:pensero:params:scim:schemas:extension:2.0:User) are already present on OIN apps; if one is missing, click Go to Profile Editor and add it with that external namespace (for manager use urn:ietf:params:scim:schemas:extension:enterprise:2.0:User).
For each attribute you want to send, click the pencil, choose Map from Okta Profile (or an expression), pick the Okta user profile field and set Apply on to Create and update. Save.
Map penseroLoginEnabled to true (or to an expression) for the people who should be able to sign in to Pensero. Login is off by default: a provisioned user is measured but cannot sign in until this attribute is true.
Map manager to the attribute that holds the manager's email, for example user.managerId if your directory stores emails there.
Do not map active or team: Okta manages active through the lifecycle actions above, and team is not applied by Pensero.

Step 5: Assign users

Go to the Assignments tab and assign people or groups to the app.
Okta pushes each user to Pensero immediately. Check Organization Settings → Users in Pensero to confirm they appear.
Optional: to link Pensero users that already exist before assigning them, go to Provisioning → Import → Import Now, then confirm the matches Okta proposes.

From now on, profile changes are pushed as they happen, and unassigning or deactivating someone in Okta deactivates them in Pensero.

Troubleshooting

Attributes that are not updated

Pensero accepts but does not apply the following attributes. Mapping them does not fail the push; the value is simply ignored:

externalId, userType, department, division, employeeNumber, title, locale, timezone, preferredLanguage, nickName, profileUrl, phoneNumbers, addresses, costCenter, organization, password.
team (Pensero extension) — logged, not applied. Manage teams in Pensero.
emails — read only when userName is not an email. An existing user's email is never changed by SCIM.
level values outside 1–3 and employeeType values other than FTE / CONTRACTOR are ignored.

Errors

Okta error	Cause	Fix
401 Unauthorized	Token missing, mistyped, revoked or regenerated, or user provisioning is not enabled for your organization (Enterprise plan required).	Generate a new token in Pensero and update API Token in Okta. If you do not see the User provisioning page, contact support.
403 Forbidden (seat limit)	Provisioning this user would exceed your seats.	Add seats, or free seats by deactivating users or assigning the Viewer role, then retry the push from Dashboard → Tasks.
409 Conflict	The email or a Git username is already used by another Pensero user or organization.	Fix the value in Okta or in the other Pensero user, then retry.
400 Bad Request	The `manager` value does not match a Pensero user's email, or `startDate` is not `YYYY-MM-DD`.	Provision the manager first, make sure the manager attribute sends their email, check the date format, then retry the push.
User created but cannot sign in	Login is opt-in.	Map `penseroLoginEnabled` to `true`. Enabling login by hand in Pensero is undone on the next full push unless the attribute is mapped.
User renamed in Okta appears as a new user	Pensero matches users by email, not by `externalId`.	Keep the user's email stable, or update the email in Pensero first and let Okta re-link on the next push.
Reactivated user has no manager or team	Deactivation ends reporting lines and team memberships and reactivation does not restore them.	Push the manager again (any profile update) and re-add the team in Pensero.

Support

For any question about the Okta integration, contact [email protected].

Set up SCIM with Okta