Setting Up SCIM Provisioning with Fathom

SCIM lets you automatically provision and manage Fathom user accounts directly from Okta. 

Fathom's SCIM integration currently only supports Okta. Other identity providers are not supported at this time. If your organization uses a different IdP, please reach out to let us know — this helps us prioritize future support.

SCIM supports:

• Creating users automatically when provisioned in Okta

• Deactivating users automatically when deactivated in Okta

• Updating basic user attributes: First Name, Last Name, Email, Timezone

• Syncing team membership via Push Groups: join and remove

• Assigns license: new users provisioned via SCIM default to Standard seats

In-Fathom Only:

• Assigning user roles (e.g. Admin vs. standard user)

• Assigning view/visibility access settings: see Team Admin Role

These two actions must be configured manually within Fathom by an admin after the user is provisioned.

1. Make sure you're logged into Fathom under the Team you'd like to associate with SCIM.

2. Open the Fathom application in Okta.

3. Under the “Sign On” tab, ensure the Application username format is set to Email:

   

4. Under the Provisioning tab, set up your integration under Integration.

5. Connect to Fathom and approve the OAuth 2.0 connection:

6. Set up the data to sync under To App. We recommend setting up at least Create Users, as it is required for Push Groups to properly manage your Fathom Teams.

7. Assign your users and groups to the Okta application to begin the sync.

If you would like Okta to have control of your Fathom Team names, deactivate the Rename Groups option under Push Groups settings:

Push Groups are the SCIM mechanism in Fathom: without one, SCIM provisioning doesn't run and users won't auto-join your organization. They're distinct from standard Okta app-assignment groups, and you can create multiple, mapping each to a different Fathom Team (create the Teams in Fathom first if needed). Test with a single user before a broad rollout to confirm they land under the expected team.

Team membership in Fathom is managed through Okta Push Groups — not standard Okta app-assignment groups. These are different mechanisms, so make sure you're using a Push Group specifically. 

Once your Push Group is created in Okta, link it to the corresponding Team in Fathom. (You’ll need to create Teams in Fathom if you haven’t yet done so.) This connection is what determines which Fathom team newly provisioned users will be added to. 

Before rolling out broadly, provision one test user through your Push Group and confirm they appear correctly in Fathom under the expected team.

These are two distinct actions with different outcomes:

• Removing someone from a Push Group unlinks their Team membership in Fathom but leaves their account active — they can still log in, and their recordings remain intact.

• Deactivating someone in Okta also deactivates their Fathom account — they can no longer log in, but does not affect their Team membership or recordings in Fathom.

Choose the action that matches what you're trying to accomplish.

When SCIM is connected, Fathom automatically runs a backfill to match existing Fathom accounts to their Okta identity (matched by email). This happens immediately — there's no preview step.

Before connecting SCIM

Make sure existing users are already placed in the correct Okta Push Group. If a user's Push Group doesn't match their current Fathom team, the backfill can unexpectedly change or remove their team membership.

Changing Team Membership via Push Groups for Users Who Predate SCIM Implementation

Okta only sends a sync when something changes on the user. If a user already existed in Fathom before being added to a Push Group, their Team stays Fathom-managed rather than Okta-managed, and no sync occurs. Moving them to a different Push Group later still won't trigger a push, since Okta sees no change relative to their current Fathom Team.

Note: This process must be completed individually for each user. Repeat the steps below for every user who needs their Team assignment handed over to Okta.

To force a sync and hand Team control to Okta:

1. Confirm the user is in the Push Group mapped to their current Fathom Team.

2. Make a small edit to the user in Okta (adding a period to the end of their name works), then push the group.

3. Confirm the change appears in Fathom, then revert the edit in Okta.

4. Remove the user from the Push Group and sync.

5. Add them to the new Push Group and sync.

The user's Team assignment is now controlled by Okta.

"I can't link an Okta group to an existing Fathom Team" Make sure you've created a Push Group (not a regular app-assignment group) and that it's properly linked to the Fathom team. If you're seeing an error in Okta, a screenshot of the error will help our team troubleshoot.

Users aren't being provisioned to the correct team This is most commonly caused by either: the Push Group isn't correctly configured, or "Update User Attributes" isn't enabled in your SCIM app settings, which can prevent team updates from syncing correctly.

I can’t send invites in the Fathom, they disappear With SCIM configured, all administration aspects of users are given to Okta, so you must add users to your Fathom Teams via Okta Push Groups.

A user exists in multiple push groups, but exist in only one Fathom team Fathom supports one group mapping per user, based on the first mapping created. A single user can't be mapped to multiple Teams.

"Users can log in to Fathom, but they aren’t a member of my Team/Organization in Fathom" To be added to your Team, the user must be assigned to a Push Group. Without a Push Group assignment, provisioning does not include them in your Team subscription.