Group Import Fails With 403 Insufficient Scope In Auth0 Express Configuration

When Auth0 Express Configuration provisions an Okta Integration Network (OIN) application, Okta fails to import groups and generates a 403 Insufficient scope error. This occurs because Auth0 Express Configuration generates a System for Cross-domain Identity Management (SCIM) token that only includes user scopes and lacks group scopes. To resolve this, Okta must adjust the integration workflow to request the necessary group scopes.

During a SCIM import, Okta calls GET /scim/v2/connections/{id}/Groups and generates the following error:

UserImportJob: Error while downloading all groups: Forbidden. Errors reported by remote server: Insufficient scope.

• Auth0
• Express Configuration
• System for Cross-domain Identity Management (SCIM) Provisioning
• Okta Integration Network (OIN)

Auth0 Express Configuration mints a SCIM token that only contains user scopes (get:users, post:users, put:users, patch:users). The token never includes the get:groups scope required for group imports.

How is the group import insufficient scope error resolved?

Auth0 Express Configuration does not currently support group imports because the Okta integration workflow lacks the necessary group scope requests. Okta must adjust the integration workflow to explicitly request the additional group scopes during the Express Configuration process.