---
title: "Take User Provisioning to the Next Level with Entitlements"
description: "This workshop extends a React and Express.js Todo application’s SCIM-based user provisioning to include entitlements such as roles, licensing, and permissions for enterprise B2B SaaS use. Starting from completed SCIM workshop code, it adds a /Roles endpoint, database-backed roles, SCIM schemas and resource types, and TypeScript implementations that conform to SCIM responses and user resources. The walkthrough connects the API to an Okta SCIM application, discovers schemas and characteristics, and demonstrates synchronizing existing entitlements and assigning a custom is_tall characteristic to a user. It also discusses multi-tenant designs, where organization-specific roles can be addressed through an API key in the Authorization header, while recommending OAuth for production."
---

# Take User Provisioning to the Next Level with Entitlements

[Okta](https://yomu.fyi/company/okta) · Alisa Duncan · Jan 21, 2026

**Type:** Tutorial

## Summary

This workshop extends a React and Express.js Todo application’s SCIM-based user provisioning to include entitlements such as roles, licensing, and permissions for enterprise B2B SaaS use. Starting from completed SCIM workshop code, it adds a /Roles endpoint, database-backed roles, SCIM schemas and resource types, and TypeScript implementations that conform to SCIM responses and user resources. The walkthrough connects the API to an Okta SCIM application, discovers schemas and characteristics, and demonstrates synchronizing existing entitlements and assigning a custom is\_tall characteristic to a user. It also discusses multi-tenant designs, where organization-specific roles can be addressed through an API key in the Authorization header, while recommending OAuth for production.

## Context

Large B2B SaaS customers may have thousands of users and require automated provisioning, synchronized access-control attributes, and fast onboarding through their identity provider. The workshop builds on earlier SCIM user-provisioning work to address roles, licensing, permissions, and other user entitlements.

## Approach / What changed

The workshop modifies the Express.js API and database to expose roles and SCIM resources, uses TypeScript to conform to SCIM schemas, connects the API to an Okta SCIM application, and demonstrates entitlement discovery and synchronization. It also describes organization-specific roles for multi-tenant applications and notes OAuth as the recommended production protection for Okta-to-API calls.

## Takeaways

- The sample API exposes a SCIM /Roles endpoint and adds roles to SCIM user operations, including creating users, listing users, and updating user roles.
- Okta can discover schemas and characteristics from the SCIM API and synchronize custom entitlements such as the is\_tall characteristic through the core SCIM User entitlements property.
- Multi-tenant implementations can target organization-specific roles using an organization API key in the Authorization header; the workshop recommends OAuth instead for production applications.

**Tags:** [Node.js](https://yomu.fyi/topic/node-js), [Okta](https://yomu.fyi/topic/okta), [SCIM](https://yomu.fyi/topic/scim), [TypeScript](https://yomu.fyi/topic/typescript)

- Source: [Okta](https://developer.okta.com/blog/2026/01/21/user-entitlements-workshop)
- Source URL: https://developer.okta.com/blog/2026/01/21/user-entitlements-workshop
- Ingested by Yomu: 2026-09-09T08:43:20.976Z

[Read original post](https://developer.okta.com/blog/2026/01/21/user-entitlements-workshop)