> For the complete documentation index, see [llms.txt](https://docs.unskript.com/unskript-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.unskript.com/unskript-documentation/guides/getting-started/authentication/okta-configuration/okta-groups-sync.md).

# Okta Groups Sync

We support manual Okta groups sync. The superAdmin group member can trigger the group sync by clicking on **Sync Okta Groups** on the User Groups tab.

## Credentials required for group sync

unSkript pulls the Okta groups info by using Okta API Token. We would need the following piece of information to configure API access to Okta

* **Tenant URL** - This is the url to your Okta domain, in the form `https://acme.okta.com`
* **API Token** - This should be generated by an Okta user who has **Read** access right to Applications and Groups Okta API. To generate API token, go to **Security->API->Tokens->Create token**
* **APP ID** - This is the ID of the Okta SAML application which was used during configuration of Okta as IDP for Auth0. On the Okta Admin panel, 
  * Go to **Applications->Application**
  *  Click on the Okta SAML application, configured for unSkript.
  * The app ID is present in the url as shown below<br>

    <figure><img src="https://491011674-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fm4p7lGuBAXN5jCVyoF7P%2Fuploads%2FYUf4lLAHXUf3Yud6xWFy%2F9592a720-abe6-4626-a2a6-6a77679728e7.jpg?alt=media&amp;token=0d3e2689-871a-4e44-8d9c-49b2da08f7ab" alt=""><figcaption></figcaption></figure>
* On unSkript, go to **More->Settings->Okta API Access** and fill in the info collected above.

<figure><img src="https://491011674-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fm4p7lGuBAXN5jCVyoF7P%2Fuploads%2Fu1H2vrS01X7X5UgZ0pDS%2F%D0%A1%D0%BD%D0%B8%D0%BC%D0%BE%D0%BA_%D1%8D%D0%BA%D1%80%D0%B0%D0%BD%D0%B0_2023-02-13_%D0%B2_19_57_36.jpg?alt=media&amp;token=7e6dda49-885a-497e-8d1b-6b7181e6c336" alt=""><figcaption></figcaption></figure>

<figure><img src="https://491011674-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fm4p7lGuBAXN5jCVyoF7P%2Fuploads%2FBpeR7q3slt0VX5cQMZqY%2F%D0%A1%D0%BD%D0%B8%D0%BC%D0%BE%D0%BA_%D1%8D%D0%BA%D1%80%D0%B0%D0%BD%D0%B0_2023-02-13_%D0%B2_19_57_40.jpg?alt=media&amp;token=3f1a1e87-7ad9-4779-bea4-e33909318ebe" alt=""><figcaption></figcaption></figure>

* With the Okta group sync enabled, users **CANNOT** create groups inside the unSkript app.
* To trigger the Okta groups sync, go to **More->User Management->User Groups** and click on **Sync Okta Groups**. These groups can be assigned unSkript roles as explained here[Role Based Access Control](/unskript-documentation/tooling/role-based-access-control.md)
* However, users still need to be invited to the unSkript app, by the admin. Go to **More->User Management->Invite User**. Since the groups are already pulled in from Okta and unSkript has the user->group mapping, user will get the role corresponding to the Okta groups, user is part of.