{{variable.Who can use this}} {{glossary.Tech admin}} and Okta admin
{{variable.Available on}} {{glossary.Any Gong plan}}

{{snippet.Admin_center_Settings_People_Team_Member_Provision}}

When setting up provisioning, ensure team members have the necessary Gong seat. Features that require seats won't be available until seats are assigned.

For more information about managing users from Okta, refer to Okta documentation.

Set up provisioning in Okta

In Okta, you must define the groups and users you want to provision to Gong. This is done by installing the Gong for Okta app and configuring the relevant settings in Okta.

Install and configure Gong for Okta app

Go to the Okta Integration Network, and add Gong for Okta. Okta is now connected to Gong.

If you installed a version below version 3 of the Gong for Okta app, learn how to migrate to version 3.

Configure the app

In Okta go to the Gong for Okta page, select Provisioning tab > Integration.
Click Configure API Integration.
Select Enable API Integration. The “Authenticate with Gong” area appears.
Click Authenticate with Gong, and sign into Gong (if asked).
Click Allow to let Okta access your account.
Click Save.
Two new tabs appear in the Provisioning tab (To App and To Okta).
In the To App tab, click Edit, and enable the following: Create Users, Update User Attributes, and Deactivate Users.
Click Save.

Set up the Gong profile in Okta

In Okta, set up a profile for the people you want to provision in Gong.

In Okta, go to Directory > Profile Editor, and locate the Gong profile.
Click the Edit icon to edit the profile. In the Attributes > All tab, you can see all the attributes in the Gong profile.
The following fields are mandatory when provisioning with Gong:
- Given name
- Last name
- Primary email: the email domain must match your company primary domain, otherwise the user won't be imported
The following fields are optional, but it’s highly recommended to configure them for your users before provisioning to avoid the need for manual updates:
Note:
Provisioned fields cannot be edited manually. If you leave a field empty, it can be manually set one time in Gong. After this, the field can’t be modified.
- Phone number: Enter the phone number in any of the following formats:
  - (865) 365-1900
  - (212) 575-1994 ext 3437
  - (317) 251-0700 ext. 468
  - (202) 903-2585 x2991
  - (206) 324-1800 x 229
  - 540.946.4600 Ext. 143
- Primary Phone Ext: Enter the extension number
- Secondary Email: Mapped to team members Additional email addresses. Used as additional ways to identify the user. Includes both additional email addresses and email aliases. See Primary and additional email address.
- Private Email: If users have a private email, configure this field.
- Title: Enter the user's job title
- Manager Email: (Recommended) Enter the manager's email address. Without this field, Gong cannot build your organization’s hierarchy.
  Note:
  The manager’s email is required for building the company hierarchy. If you set the assignment to automatic updates, this field must be provided.
- Manager Full Name: In the format firstname lastname, e.g. John Doe. The manager’s full name should be provided if you can’t provide the manager’s email. If neither this field or the Manager ID field are defined, Gong cannot automatically build your organization hierarchy. Note that, if there's more than one manager with the same name, Gong can't set the manager for the user and you'll have to set this manually in Gong. This method is not recommended for building the company hierarchy.
- Time zone: Use any value from the list of time zones in List of tz database time zones.
  Note:
  Updating the user’s time zone after they have been provisioned can only be done by updating their time zone in Okta. Changing their country won’t change their time zone.
- Country: Enter the country’s full name or 2 or 3 letter country code, according to ISO 3166-1 alpha-2 codes
- State or Province: Enter the full state or province name, or two letter code according to the following ISO codes:
  - US: ISO 3166-2:US
  - Canada: ISO 3166-2:CA
  - Australia: ISO 3166-2:AU (for Australia the state code can be 2 or 3 letters)
- Locale: Use the following format: en-US. If you don’t define a locale for a user, they are assigned en-US by default. This field is used in Gong to identify the user's weekend in order to avoid sending notifications when the user is not working.

Timezone calculation

Notes:
Timezone offsets (e.g. -05:00) are not supported.
Updating the user’s time zone after they have been provisioned can only be done by updating their time zone in Okta. Changing their country won’t change their time zone.

Gong calculates the user timezone according to the following hierarchy:

Time zone attribute from Okta, if provided.
Country attribute from Okta, if provided.
State-or-Province attribute from Okta, in a country where timezones are different between states or provinces.
Default timezone, as set for the company in Gong.

Provision users or groups

Note:
When testing SCIM provisioning with users created in Okta, make sure the users are activated. Otherwise, there's a chance the users stay in 'staged' state, and not all functionalities will work.

To provision users and groups to Gong, assign them the Gong.io app by doing one of the following:
- Open the user or group window, go to the Application > Assign Application tab, and select Gong.io.
- Open the applications window, go to the Applications tab and select Gong.io. In the Assignment tab, select users or groups to assign to Gong and click Assign.
Gong is assigned to the user or all the users in the group.
If you already use Okta SAML SSO authentication: In Okta, unassign anyone that is already assigned to Gong, otherwise they will not be provisioned when you perform this task.
In Okta, go to the Gong app > Push Groups tab, and locate the group/s you want to use in Gong, and push them to Gong.

Set up provisioning in Gong

Once you have set Okta up to provision to Gong, configure the automatic provisioning settings in Gong.

Set Okta as your IDP

Go to Admin center > Settings > People > Team Member Provisioning.
In Provisioning source, select Okta. A default assignment is set up where team members imported with this assignment are not assigned any seats, data capture capabilities or permissions. You can edit this or set up assignments for different teams.
In the Manager's provisioning settings area:
1. Select Notify direct managers with recorded teams when a new team member is imported to send a notification by email when new team members are automatically provisioned.
2. Select Managers can turn data capture on or off for their team to allow direct managers to change the data capture settings for their team members.
  Note: This setting lets managers enable data capture despite not being a technical admin. If you only want appointed tech admins to have this capability, make sure this box is not checked.
Click SAVE.
Click Add assignments to create a new assignment or click an assignment you want to edit to assign seats, data capture settings, workspaces, and permissions to provisioned team members.

Upgrade from one Gong app to a later version

If you originally installed a version of the Gong for Okta app that is older than version 3, upgrade to version 3 to get the following fields: Manager Email, Manager Full Name, Private Email, Country, State or Province, and Primary Phone Ext.

Add a new instance of Gong in your Okta org. Follow these steps to migrate from to the latest instance of Gong:

Login to your Okta org as an Admin.
Open the Admin dashboard, and click Add Applications.
Add a new instance of Gong.
Configure the application including Provisioning.
See step 3 above for more information. After SCIM Provisioning has been enabled, go to the Assignments tab of your new Gong app instance.
Click Assign and start assigning the same users/groups that are assigned to your old Gong instance.
Note:
Make sure you assign all the users to your new Gong instance to avoid any accidental de-provisioning/loss of access for your users.
Go back to your Admin dashboard, and open your old Gong app instance.
Go to the Provisioning tab, and in the SETTINGS section, click API.
Click Edit and clear the Enable API Integration checkbox.
Click Save.
You can now deactivate or delete your old Gong app instance and start using the new instance.
Important:
If you were using SAML as the sign-on mode for your old Gong app instance, you will need to set up SAML on your new app instance in Okta (recommended) or maintain the old app instance to ensure that the SAML functionality continues to work. See this guide to set up SAML.

Identity & Provisioning