# iOffice + Okta integration > Sync employee identity data between Okta and iOffice to speed up onboarding, access provisioning, and workplace resource management. **Canonical page:** https://tray.ai/connectors/ioffice-okta-integrations/ **iOffice connector:** https://tray.ai/connectors/ioffice-integrations/ **iOffice documentation:** https://tray.ai/documentation/connectors/service/ioffice **Okta connector:** https://tray.ai/connectors/okta-integrations/ **Okta documentation:** https://tray.ai/documentation/connectors/service/okta ## Overview iOffice and Okta do different jobs: iOffice handles physical space, assets, and workplace resources, while Okta manages digital identity and secure access. When they run independently, IT and facilities teams end up manually reconciling user data, which means provisioning delays, security gaps, and a lot of tedious cleanup. Connecting iOffice with Okta through tray.ai automates the synchronization of employee records, access rights, and lifecycle events across both systems. When an employee joins, changes roles, or leaves, both Okta and iOffice need to reflect that — immediately. Without integration, HR and IT teams spend hours manually updating accounts, assigning workspace access, and revoking permissions. That's not just slow; it's a security problem. Connecting iOffice and Okta on tray.ai lets teams automate the full employee lifecycle: provisioning iOffice accounts when a new user appears in Okta, updating workspace assignments when roles change, and deactivating iOffice access the moment a user is deprovisioned in Okta. The result is a secure, auditable workplace that doesn't fall apart as your organization grows. ## Use cases ### Automated Employee Onboarding Across Physical and Digital Systems When a new employee is added to Okta, tray.ai automatically creates a matching iOffice profile and assigns the right building access, desk reservations, and workspace permissions based on department or role. Facilities teams don't have to touch it, and new hires are set up before day one. - New employees have workplace access configured before their first day - Eliminates manual data entry across HR, IT, and facilities teams - Access policies stay consistent and tied to Okta group membership ### Real-Time User Deprovisioning and Access Revocation When an employee is deactivated in Okta, tray.ai immediately deactivates their iOffice account, cancels any pending room or desk reservations, and removes their physical access entitlements. No lingering access, no manual follow-up. - Physical workplace access is revoked the moment Okta deprovisioning fires - Future workspace reservations are cancelled automatically for departed employees - Both platforms maintain a clean, auditable access record ### Role Change and Department Transfer Synchronization When an employee's department, title, or Okta group membership changes, tray.ai updates their iOffice profile to reflect the new role, reassigns them to the right floor or workspace zone, and adjusts resource access accordingly. No ticket required, no manual intervention. - Workspace assignments automatically reflect organizational changes - Fewer tickets for facilities and IT support teams - Employees always have access to the resources their role requires ### Unified Directory and Profile Sync tray.ai continuously syncs employee profile data — name, email, department, location — from Okta's Universal Directory into iOffice, so workplace records stay accurate. No more duplicate profiles or outdated contact information cluttering iOffice. - Okta becomes the single source of truth for employee data across both platforms - Stale and duplicate iOffice records are eliminated - IT and facilities teams spend less time manually reconciling data ### Conditional Workplace Access Based on Okta Group Policies Using Okta group membership as the trigger, tray.ai can automatically grant or restrict specific iOffice features — conference room booking, visitor management, executive floor access — based on predefined policy rules. Least-privilege principles apply to physical spaces, not just software. - Premium workspace resources are restricted to authorized groups - Policy enforcement is consistent, automated, and auditable - Reduces risk of unauthorized use of sensitive workplace areas ### Visitor and Contractor Lifecycle Management When a contractor or visitor account is provisioned in Okta with a defined expiry date, tray.ai creates a time-limited iOffice visitor profile with matching access windows, then deactivates it automatically when the Okta account expires. Temporary workers don't retain access beyond their engagement. - Temporary iOffice access is tied directly to the Okta account lifecycle - Automatic expiration prevents orphaned contractor profiles - Compliance reporting for short-term access grants is much simpler ### Audit and Compliance Reporting Across Workplace and Identity Systems tray.ai periodically reconciles user access records between Okta and iOffice, flags discrepancies where iOffice accounts exist without a corresponding active Okta identity, and generates compliance reports for security audits. That makes SOC 2, ISO 27001, and similar access governance frameworks a lot easier to support. - Orphaned and mismatched accounts are detected automatically - Audit trails span both identity and workplace systems - Less manual effort during security reviews and certification cycles ## Templates ### New Okta User → Create iOffice Employee Profile Automatically creates a new iOffice user profile and assigns default workspace resources whenever a new user is activated in Okta, cutting out manual provisioning for IT and facilities teams. Connectors used: Okta, iOffice ### Okta User Deactivation → Deprovision iOffice Access Instantly deactivates an employee's iOffice account and cancels all future workspace and room reservations when their Okta account is deprovisioned, so no residual access remains. Connectors used: Okta, iOffice ### Okta Group Change → Update iOffice Workspace Assignment When an employee moves to a new Okta group due to a department transfer or promotion, this template automatically updates their iOffice workspace zone, permissions, and resource access to match their new role. Connectors used: Okta, iOffice ### Scheduled iOffice–Okta Directory Reconciliation Runs on a schedule to compare active user records between Okta and iOffice, updates out-of-sync profiles, and flags orphaned iOffice accounts that no longer have a corresponding active Okta identity. Connectors used: Okta, iOffice ### Okta Contractor Account Expiry → Auto-Deactivate iOffice Visitor Profile Monitors Okta for contractor or temporary accounts approaching their expiry date and automatically deactivates the associated iOffice visitor profile on the expiration date, preventing lingering access. Connectors used: Okta, iOffice ### Okta Profile Update → Sync iOffice Employee Record Whenever employee attributes like name, email, phone number, or location are updated in Okta, this template immediately pushes those changes to the corresponding iOffice record, keeping the workplace directory accurate. Connectors used: Okta, iOffice ## Challenges Tray.ai solves ### Mapping Okta Groups to iOffice Permission Structures Okta organizes users into groups and assigns application policies, while iOffice has its own internal hierarchy of buildings, floors, zones, and resource categories. Translating Okta group membership into the correct iOffice access structure requires careful mapping, and it tends to break when organizational structures change. **How Tray.ai helps:** tray.ai's visual workflow builder lets teams define flexible mapping logic between Okta groups and iOffice permission sets without writing custom code. Mapping tables can be updated as the organization changes, and conditional logic handles edge cases like multi-group memberships or temporary role assignments. ### Handling Provisioning Delays and Race Conditions When multiple lifecycle events fire simultaneously — a user added to Okta at the same moment their iOffice profile is being created — race conditions can produce duplicate profiles, incomplete provisioning, or conflicting access states across the two systems. **How Tray.ai helps:** tray.ai supports built-in retry logic, error handling branches, and sequential step execution to prevent race conditions during provisioning workflows. Teams can configure idempotency checks to verify whether a profile already exists before creating a new one, and alerts can be routed to Slack or email when exceptions occur. ### Keeping User Identifiers Consistent Between Systems iOffice and Okta may use different primary identifiers — employee ID, email address, custom attributes — making it hard to reliably match records across the two platforms, especially when emails change or accounts are merged. **How Tray.ai helps:** tray.ai lets teams define a canonical matching key — such as a shared employee ID or work email — and build lookup logic that resolves the correct iOffice record for any given Okta user. The platform supports custom attribute mapping and data transformation to normalize identifier formats across both systems. ### Compliance During Offboarding Without Disrupting Active Employees Revoking iOffice access at the moment of Okta deprovisioning matters for security compliance, but overly aggressive automation can accidentally revoke access for employees on leave or in the middle of a role transition. That causes real operational headaches. **How Tray.ai helps:** tray.ai workflows support conditional logic that checks the specific reason for an Okta status change before triggering iOffice deprovisioning. An account suspension for parental leave can be handled differently from a permanent termination, with configurable hold periods, manager approval gates, or soft-deactivation steps built into the workflow. ### Scaling Integrations Across Multiple Locations and Okta Tenants Large enterprises may run multiple iOffice instances for different campuses or regions, and some manage multiple Okta tenants across business units. Keeping provisioning logic consistent across all those environments is genuinely complex, and configuration drift is a real risk. **How Tray.ai helps:** tray.ai's multi-tenant architecture and reusable workflow templates let teams build a single provisioning workflow and deploy it consistently across multiple iOffice instances or Okta tenants. Centralized logging and monitoring give visibility into provisioning activity across all environments from one dashboard. ## Learn more - Intelligent Integration: https://tray.ai/platform/intelligent-ipaas/ - Merlin Agent Builder: https://tray.ai/platform/merlin-agent-builder/ - Agent Gateway for MCP: https://tray.ai/platform/agent-gateway/ - Book a demo: https://tray.ai/contact/