BiAccounts in applications
Okta to Bitwarden integration: members and groups from Okta, revoked on deactivation
With an integration between Okta and Bitwarden, users assigned to Bitwarden in Okta become members of the Bitwarden organisation, Okta groups come along as Bitwarden groups, and a member is revoked as soon as the user is deactivated in Okta. Bitwarden itself offers a SCIM app in the Okta catalogue for this; KoppelHet fills the gaps where it stops, such as suspended users, changed email addresses and cleaning up revoked members.
What the integration does
Organisations that manage all access in Okta and have connected Bitwarden through the Okta catalogue run into two gaps. An employee on long-term leave is suspended in Okta but keeps access to shared collections in Bitwarden, and after a name change someone gets a second invitation and an empty vault.
- IT assigns Bitwarden in Okta to the groups that need access, and pushes those groups to Bitwarden.
- The users arrive in Bitwarden as members, in their groups, and receive an invitation.
- The member accepts the invitation and an administrator confirms them, after which their groups' collections become visible.
- When a user is suspended in Okta, KoppelHet revokes the member in Bitwarden; after the suspension KoppelHet restores access.
- On deactivation the Okta app revokes the member. After an agreed period KoppelHet removes revoked members from the organisation.
What to watch for with Okta and Bitwarden
- According to Bitwarden, suspending in Okta does not lead to revocation in Bitwarden; only deactivating or deleting does. KoppelHet revokes a suspended user itself and restores them when the suspension ends. According to Bitwarden a restored user does not need to be invited or confirmed again.
- Bitwarden does not support changing an email address after provisioning. If the login in Okta changes, for example after a name change in the HR system, KoppelHet alerts the Bitwarden administrator before the Okta app creates a second member.
- Even a user deleted in Okta is only revoked in Bitwarden and not removed from the organisation. KoppelHet removes revoked members after a period you choose, so the member list matches Okta.
- Groups only reach Bitwarden once they are pushed in Okta. A new group that is only assigned does produce members but no group, and therefore no access to the collection. KoppelHet compares assigned and pushed groups and reports differences.
- New members are staged in Bitwarden by default without an invitation and then do not count as a licence. With the setting for automatic invitations you decide whether the invitation goes out straight away, for example only when Okta activates the user on the start date.
- Besides SCIM, Bitwarden also has Directory Connector for Okta. It does not include nested groups, stops at 2,000 users or groups by default and only syncs while the app is running. For organisations with SCIM, the Okta app is the better route.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Why not just the Bitwarden app in Okta?
Often it is enough. If you use suspension in Okta for leave or investigations, or email addresses change with name changes, KoppelHet fills the gaps.
Does a suspended employee get a new invitation after returning?
No. KoppelHet restores the revoked member; according to Bitwarden re-inviting or confirming is then not needed.
Does KoppelHet see the passwords in Bitwarden?
No. The Public API manages members, groups and collections, but no vault items. KoppelHet therefore cannot reach the content of the vault.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Bitwarden app in the Okta catalogue with SCIM. Provisioning to App with Create Users and Deactivate Users; Bitwarden's SCIM URL as Base URL and the SCIM API key as API Token. Groups through Push Groups. Email and username must be the same; an email type other than primary is not supported.
- KoppelHet reads Okta through the Users API (status SUSPENDED and DEPROVISIONED, changed login) and the app assignments, with a read-only OAuth 2.0 service app. Bitwarden is written through the Public API (api.bitwarden.com or api.bitwarden.eu) with the organisation API key; revoke and restore through the member endpoints from release 2026.2, members and groups retrieved with continuationToken.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Okta | Field in Bitwarden | Notes |
|---|---|---|
Okta-gebruiker (id) | externalId van het lid | |
login | userName | Same as the email address |
email (primary) | emails | Cannot be changed after provisioning |
firstName en lastName | name | |
Status DEPROVISIONED | Lid ingetrokken (door de Okta-app) | |
Status SUSPENDED | Lid ingetrokken (door KoppelHet) | The Okta app does not revoke on suspension |
Gepushte groep met leden | Groep met leden |
Related
ADP GlobalView → Okta
ADP GlobalView to Okta integration: Okta users from all countries in GlobalView
ADP iHCM → Okta
ADP iHCM to Okta integration: ADP as the HR source for Okta, with groups per country
ADP Workforce Now → Okta
ADP Workforce Now to Okta integration: ADP as the HR source for Okta
AFAS Profit → Okta
AFAS to Okta integration: AFAS Profit as the HR source for all accounts and apps