Skip to content
shuffl
Get started

Searches the public product guides only. Nothing from a workspace is read, and questions are not saved.

How-to guide

Use Shuffl with Okta

Connect Okta to push people and groups to Shuffl and sign everyone in, and see what Shuffl does with it.

For HR and IT administrators

Have your agent do thisPaste the prompt into Claude Code, Cursor or another agent. It follows this guide over MCP and asks before it changes anything others will see.Show the prompt
Help me with "Use Shuffl with Okta" in my Shuffl workspace.

1. Read the guide: https://shuffl.ai/docs/markdown/okta
2. Add Shuffl's MCP server: https://shuffl.ai/api/mcp
   Claude Code: claude mcp add --transport http shuffl https://shuffl.ai/api/mcp
   When the browser opens, choose my workspace and allow the access the guide needs.
3. Work through the steps in order: Push people from Okta; Sign in with Okta. Do what you can over MCP and tell me which steps only I can do in the browser or in Slack.

Show me what you will change and who it affects, and wait for my yes before publishing, inviting or sending anything.
On this page

App links open your signed-in workspace. Check the selected workspace before making changes.

What Okta does in Shuffl

Okta can push people, groups, titles, departments and managers to Shuffl over SCIM, and sign everyone in. Unassign someone in Okta and their access ends at once.

You need to be a Shuffl workspace administrator, with an administrator in Okta for the steps there.

Push people from Okta

  1. In Shuffl, open Settings → Workspace → Integrations → Provisioning and choose New SCIM connection. Copy the base URL and the token, which is shown once.
  2. In Okta, turn on SCIM 2.0 provisioning for a Shuffl app. Paste the base URL into SCIM connector base URL and the token under HTTP Header authentication.
  3. Turn on creating, updating and deactivating users, send the work email as the user name and assign the people who belong in Shuffl.
  4. Back in Shuffl, under Who gets workspace access?, choose Everyone assigned to this app or Selected groups only, then Save access policy.
  5. To use a pushed group in Shuffl, open People → Sync, choose Groups on the SCIM card and turn it on.

What comes in

Okta sends each change as it happens. Shuffl only reads; it never changes anything in Okta.

Okta’s values replace People’s on every update, so fix a wrong title or manager in Okta. A blank keeps what People has.

From Okta into Shuffl

  • Everyone, with names and work emails
  • Job titles
  • Managers
  • Departments
  • Teams and groups, the ones you choose
  • Leavers

What it does for HR

In Shuffl

  • Managers fill the org chart, so playbook meet steps, manager to-dos and 30/60/90 plans reach the right person.
  • Departments become department groups, so Pulse, eNPS and Culture compare teams without exposing anyone.
  • Teams you bring in become synced groups for Pulse questions, automations, Connections and messages.
  • Suspended or removed accounts lose their Shuffl access.
  • Mello knows each person’s title, manager and department when it answers.

Sign in with Okta

  1. In Shuffl, open Settings → Workspace → Integrations → Single sign-on, choose Add connection and pick OpenID Connect. Keep the values it shows open.
  2. In the Okta Admin Console, open Applications, choose Create App Integration, then OIDC and Web Application.
  3. Paste the redirect URI into Sign-in redirect URIs and the login URL into Initiate login URI. Keep Client secret as the client authentication.
  4. Assign the people or groups who should sign in, then copy the client ID and secret. The issuer is your Okta domain.
  5. Add the DNS TXT record the connection shows at your DNS provider, then choose Check DNS record until it reads Verified.
  6. In a private window, choose Sign in with SSO with a work email that is in People with access enabled.

Single sign-on proves who someone is; People still decides who gets in. Set up People first, and password sign-in keeps working while you test.

With your other systems

Okta sends no start dates. Connect your HR system for those, so playbooks and anniversaries have them. Okta keeps names, emails and access.

If it stops working

If people stop arriving, read the provisioning errors in Okta. Tokens expire after 90 days: choose Rotate token in Shuffl, paste the new one into Okta, test it, then revoke the old one.

Unassigning someone in Okta suspends their access at once. Restoring them doesn’t undo a suspension made by hand.

Was this guide helpful?