This guide is a quick setup and management guide for the SCIM integration with Nooks.

Quick Start

Step 1: Enable SCIM in Nooks

1. Admin Panel: Log into you Nooks Workspace as Admin.

2. SCIM Settings: Go to Settings → Identity and Provisioning.

3. Enable SCIM Provisioning: Toggle SCIM Provisioning on.

   

4. Generate Token: Click Generate SCIM Token.

   1. Note: You’ll need to re-generate the token by choosing the 🔄 icon to view and copy the bearer token.

5. Copy Config: Note the Base URL and Bearer Token.

   

Step 2: Configure Identity Provider

Okta

1. Create SCIM App:

   1. In Okta Admin Console, navigate to Applications →Applications→Browse App Catalog.

   2. Search for SCIM 2.0 Test App (OAuth Bearer Token) and select Add Integration.

      

2. Configure Settings:

   1. Navigate back to Applications →Applications→ and choose the newly created SCIM App.

   2. Select the Provisioning tab and choose Configure API Integration.

      

   3. Select the checkmark to Enable API Integration.

   4. Enter the following:

      • SCIM 2.0 Base URL: https://api.nooks.in/scim/v2

      • OAuth Bearer Token: Use generated SCIM token from Nooks (listed above in Step 1: Enable SCIM).

        

3. Add Provisioning to App permissions.

   Typically you want the SCIM connector to handle all provisioning, de-provisioning, and permissions updates based on roles in Okta. If that is the case, make sure to enable each of these permissions so the connector can take those actions when appropriate.

   

4. Create Custom Attributes:

   1. In Okta Admin Console, navigate to Applications →Applications, then choose the newly created SCIM App.

   2. Select the Provisioning tab and choose To App.

   3. Scroll down and select Go to Profile Editor.

      

   4. Click +Add Attribute.

      

   5. Enter the following to create the “entitlements” and “roles” attributes:

      1. For the “entitlements” attribute:

         • Data Type: string array

         • External Name: entitlements

         • External Namespace: urn:ietf:params:scim:schemas:core:2.0:User

         • Attribute type: Group

         • Group Priority: Combine values across groups

      2. For the “roles” attribute:

         • Data Type: string array

         • External Name: roles

         • External Namespace: urn:ietf:params:scim:schemas:core:2.0:User

         • Attribute type: Group

         • Group Priority: Combine values across groups

   6. Note: When you set Attribute Type to Group, Okta exposes two combination strategies. They behave very differently:

      Strategy	Behavior	When to Use
      Combine values across groups	UNIONs the values from every group the user belongs to. A user in Nooks-Power-Dialer (entitlement value powerDialerBullpen) AND Nooks-Coaching (entitlement value training) is sent to Nooks with entitlements: ["powerDialerBullpen", "training"].	This configuration enables one-group-per-dimension setups in Okta (one group per dialer tier, one per add-on like Coaching/International, one per role) and can help avoid combinatorial group explosion.
      Use Group Priority	Only the highest-priority group’s value is sent. A user in both Nooks-Power-Dialer and Nooks-Coaching would receive only the top-priority group’s value (e.g., powerDialerBullpen) — the other group’s value is dropped.	Useful when you want exactly one group to win for an attribute and no merging across groups. If you want this, but need to support lot’s of combinations, you’d end up forced into combo groups like Nooks-Power-Dialer-with-Coaching, Nooks-Power-Dialer-with-International, etc.

5. Assign Groups:

   1. Navigate back to Applications →Applications→ and choose the newly created SCIM App.

   2. Select the Assignments tab → Assign → Assign to Groups.

      

   3. Select the group you wish to add and choose Assign.

   4. Scroll down to Entitlements and Roles and choose Add Another.

      

   5. Refer to Role Access and Entitlements Access below for the strings you wish to assign.

   6. Enter the strings and click Save at the bottom.

      

6. Push Groups:

   1. Select the Push Groups tab → +Push Groups → Find Groups By Name.

   2. Search for the Groups you wish to push and click Save when finished.

      

   3. When the push status is Active, the entitlements and roles have been pushed to Nooks.

      

Azure AD

1. Create Enterprise App: In Azure Portal.

2. Configure SCIM: Set up provisioning with base URL and Bearer Token.

3. Map Attributes: Configure mappings.

4. Enable Provisioning: Turn on automatic provisioning.

Access Types

Nooks user access is managed via the SCIM entitlements field on each user object. This field is an array of strings that specify the access levels and features assigned to the user.

How It Works

• The entitlements array determines what type of seat and features a user receives in Nooks.

• Only one seat access level is assigned per user, based on the highest-priority entitlement present.

Entitlements Access

Roles Access

Additional Access (Add-on Entitlements)

These are add-on entitlements that grant features alongside a base seat. Unlike the seat access levels above (where one wins), add-ons combine: a user can hold any base seat AND any number of add-ons at the same time.

Enabling Sequencing via SCIM

Sequencing became available as a SCIM entitlement in June 2026. Because existing workspaces may already have Sequencing access assigned in Nooks, it is not pushed automatically. To start managing Sequencing seats through SCIM, you must first enable the "Sequencing seats via SCIM" toggle in your workspace's SCIM settings. For workspaces setting up SCIM for the first time, it is automatically enabled.

Important: Once this toggle is on, your IdP becomes the source of truth for Sequencing access. Any user who does not have the sequencing entitlement in your IdP will lose access to Nooks Sequencing on their next provisioning sync. Assign the entitlement to all intended users in your IdP before enabling the toggle.

This opt-in toggle exists so that turning on SCIM entitlement sync never silently removes Sequencing access from users who were provisioned before June 2026.

Admin Group Configuration Overrides

SCIM group configuration overrides allow workspace administrators to control access for all members of a SCIM group, regardless of individual user entitlements. These overrides take highest priority.

Configuration Process

1. Access: Admin → SCIM Configuration → Group Mappings.

2. Configure: Set access type.

3. Apply: Changes apply immediately to all group members.

Priority Hierarchy

1. Access: Admin → SCIM Configuration → Group Mappings

2. Configure: Set access type

3. Apply: Changes apply immediately to all group members

Examples

Override Individual Entitlements

// User has: ["bullpen"]
// Admin configures group: powerDialerBullpen
// Result: User gets powerDialerBullpen

Remove Group Override

// User has: ["powerDialerBullpen"]
// Admin removes group config
// Result: User falls back to powerDialerBullpen

Add-on Group Pattern (Coaching, International)

Instead of bundling Coaching or International into every group (e.g. creating separate "Power-Dialer-with-Coaching" and "Power-Dialer-without-Coaching" groups), you can choose to use a dedicated add-on group that only contributes the add-on. Users get the add-on by being a member of both their dialer-tier group AND the add-on group.

This is pattern is nice when only a subset of your users need Coaching or International. It keeps your group count manageable instead of doubling for every add-on dimension.

Example: A Coaching-only add-on group

1. In your identity provider (Okta / Azure AD / etc.), create a group named something like Nooks-Coaching. Assign the users who should have Coaching access. These users must ALSO be in one of your dialer-tier groups (Bullpen, Power Dialer, or Parallel Dialer) — the add-on group does not grant a dialer seat by itself.

2. Push the group to Nooks via SCIM (Push Groups tab in your SCIM app — see Configure Identity Provider step 6 above).

3. In Nooks, go to Admin → SCIM Provisioning → SCIM Groups & Entitlements, find the Nooks-Coaching group in the list, and click the Configure icon to open the Admin Configuration dialog.

4. Configure the override as follows:

   Field	Value	Why
   Access	No Access	This group should not contribute a dialer seat — the user's dialer seat comes from their other group.
   Role	(leave blank)	Role is set by other groups (or directly).
   Training Seat	☑ checked	This is what the group actually grants.
   International Seat	☐ unchecked	Not granted by this group.

5. Save the configuration. Users in the group now receive Coaching on top of whatever dialer tier their other group assigns.

The same pattern works for International: Create a Nooks-International group, follow the same steps, and check International Seat instead of (or alongside) Training Seat. Users in this group receive International dialing on top of their dialer tier.

Combining add-ons in one group: You can also create a single Nooks-Coaching-and-International group with both Training Seat and International Seat checked. Use this when the same set of users always needs both add-ons together; otherwise keeping the two groups separate is more flexible.

How merge works when a user is in multiple groups: When a user is in several Nooks-configured groups, the fields combine as follows.

So a user in Dialer-Power-Dialer (Power Dialer, no add-ons) + Nooks-Coaching (No Access, Training Seat checked) ends up with a Power Dialer seat + Coaching — exactly the additive outcome you'd expect.

Best Practices

1. Plan Group Structure: Design groups based on access requirements.

2. Document Configurations: Keep records of group access levels.

3. Monitor Seat Usage: Group configs consume seats.

4. Test Changes: Verify in test environment first.

Common Scenarios

Assigning a New User

Option A: Group Assignment (recommended)

1. Create user in identity provider

2. Add to a Nooks-relevant SCIM group (e.g. Nooks-Bullpen, Nooks-Power-Dialer, etc.)

3. Make sure that group has an admin override configured in Nooks Admin → SCIM Groups & Entitlements

Option B: Direct Assignment (only when no group has an admin override)

1. Create user in identity provider

2. Assign entitlements: ["bullpen"] (basic access for new reps)

Use Option A in production. Option B is supported only for workspaces with zero group admin overrides; as soon as any group has an override configured, per-user entitlements stop applying for users in any configured group.

Worked Example: Full-stack SDR

An SDR who needs parallel dialing and AI Coaching:

1. In your identity provider (Okta / Azure AD / etc.), add Jane to your Nooks-Parallel-Dialer group and your Nooks-Coaching add-on group. Push both groups via SCIM.

2. In Nooks Admin → SCIM Provisioning → SCIM Groups & Entitlements, configure both groups:

   • Nooks-Parallel-Dialer: Access: Parallel Dialer + Bullpen, Role: User, Training Seat unchecked, International Seat unchecked.

   • Nooks-Coaching: Access: No Access, Role blank, Training Seat checked, International Seat unchecked.

3. Result: Jane gets a Parallel Dialer seat as a user, plus the AI Coaching add-on. Her entitlements merge from both group admin configs.

Alternatively, for workspaces with no group admin configs at all, you can send entitlements directly on the per-user SCIM payload:

{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "jane.doe@acme.com",
  "name": { "givenName": "Jane", "familyName": "Doe" },
  "emails": [{ "value": "jane.doe@acme.com", "primary": true }],
  "active": true,
  "entitlements": ["parallelDialerBullpen"],
  "roles": ["user"]
}

This only works if no group in your Nooks workspace has an admin override configured. As soon as any group has an admin override, per-user entitlements are ignored for users in those groups; configure entitlements through group admin overrides instead.

Granting Coaching or International to a Subset of Users

Use the add-on group pattern described in the Admin Group Configuration Overrides section above. Setting training or international on the per-user entitlements array via your identity provider alone does not reliably apply the add-on — configure it through a group override in Nooks Admin instead.

Updating Dialer Access

Option A: Direct Update

1. Update entitlements to ["powerDialerBullpen"] (upgrade to dialer access)

Option B: Group Transfer

1. Remove from "Sales Representatives" group.

2. Add to "Senior Sales" group.

Employee Leaves

Option A: Direct Removal

1. Set entitlements to [] or ["none"]

Option B: Group Removal

1. Remove from all groups

Option C: SCIM Unassign or Deactivate

1. Use the SCIM API to "unassign" the user by either:

   • Sending a PATCH or PUT request with entitlements: [] or entitlements: ["none"] to remove all access, or

   • Setting "active": false for the user. When active is updated to false, all entitlements will be reset and any assigned seats will be freed automatically.

Troubleshooting

User Not Getting Expected Access

Causes:

• Entitlements field missing from SCIM request

• Invalid entitlement values

• Admin group configuration overriding user entitlements

• Insufficient seats available

Solutions:

1. Check SCIM request payload includes entitlements

2. Verify entitlement values are correct

3. Check admin group configurations

4. Review seat availability

Access Removed Unexpectedly

Causes:

• Empty entitlements array sent in SCIM request

• User removed from all groups

• Admin group configuration changed

Solutions:

1. Review SCIM provider configuration

2. Check group memberships

3. Verify admin group configurations

Seat Limit Errors

Causes:

• Too many users assigned to high-tier access

• Group configurations consuming too many seats

• Seat plan needs upgrade

Solutions:

1. Review current seat usage

2. Consider upgrading seat plan

3. Optimize group configurations

4. Remove access from inactive users