Setting up Opti Id SSO with and without SCIM

This blog compiled learnings, when setting up Opti Id for large enterprises using SCIM and its pros and cons when setting up Opti Id without SCIM.

What is Opti ID and why does provisioning matter?

Opti ID is Optimizely's unified identity layer — a single login that spans all Optimizely products including CMS, CMP, and beyond. Once authenticated, users access every product and instance they are entitled to from a single dashboard, without logging in again.

But authentication is only part of the story. For large, fluid user populations, the harder challenge is provisioning — how user accounts are created, kept current, and deactivated as people join, change roles, or leave. Opti ID supports two distinct models for this.

▸  APPROACH A

SSO without SCIM — Setup & Considerations

This approach uses your identity provider purely for authentication. All user management — invitations, group assignments, role changes, and deactivations — is carried out manually inside the Opti ID Admin Centre. Any IdP supporting SAML or OIDC is compatible.

Setup Steps

     1. Designate a technical owner — One person logs into Opti ID first to establish the organisation and handle initial configuration. This person acts as the first Opti ID administrator and delegates access from there.

     2. Configure SSO connections in your IdP — Add Opti ID as a SAML or OIDC application in your identity provider. Up to five SSO connections can be configured — useful for separating geographies, business units, or external users under distinct connections.

     3. Register your organisational domains — In Opti ID Admin Centre under Settings > SSO/ Domains, register the SSO / DNS domains your internal users authenticate with. This auto-routes users to the correct SSO connection at login.

     4. Handle external and partner users via selective local login — Enable selective local login to give partner individuals a standalone Opti ID account (email + password, MFA optional). Internal users continue authenticating via SSO; external users get a local account managed per-user in the Admin Centre.

5. Create groups and assign roles manually — Build a group structure in the Admin Centre reflecting your organisational needs — by region, product, or access tier. Invite users individually, assign them to groups, and those groups determine which product instances and roles each user can access.

▸  APPROACH B

SSO with SCIM — Setup & Considerations

SCIM (System for Cross-domain Identity Management) extends your SSO setup by automating the full user lifecycle. Your identity provider becomes the single source of truth — users and groups defined are pushed to Opti ID automatically, including deprovisioning when someone leaves. Officially supported with Microsoft Entra ID, Okta, and PingOne.

Setup Steps

      1. Designate a technical owner and configure SSO — Same starting point as Approach A. Configure your primary SSO connection first — the SCIM configuration option only becomes available after at least one SSO connection is active.

      2. Generate a SCIM token in Opti ID — Navigate to Admin Centre > Settings > Authentication > SCIM. Select the SSO connection you want to associate SCIM with and generate the bearer token. This token authenticates your IdP when it pushes user data to Opti ID.

      3. Create a SCIM provisioning app in your IdP — Most enterprise IdPs require a separate application for SCIM provisioning, distinct from the SSO app. Configure it using the Opti ID SCIM endpoint URL and token generated above. Some IdPs (such as Okta) allow combining SSO and SCIM in a single app — check your provider's documentation.

          4. Design your group structure and push groups from your IdP — Create groups in your IdP corresponding to the access tiers you need — by region, role, or product. Assign users to these groups. When SCIM syncs, those groups and members are automatically created in Opti ID. Future membership changes propagate within minutes.

       5. Map groups to product instances and roles in the Admin Centre — SCIM delivers users and group memberships — it does not configure product instance access or role assignments. In the Admin Centre, map each SCIM-synced group to the appropriate instances and permission levels.