Issue
I'm trying to provision users with the Sentry Owner role through Okta SCIM, but it fails.
Applies To
Customers using Okta SCIM for user provisioning in Sentry
Business and Enterprise plans
Resolution
The Owner role cannot be provisioned or assigned through Okta SCIM. This is a deliberate safeguard: it prevents organization owners from being automatically removed or downgraded by identity provider changes. More generally, SCIM cannot assign any role that carries organization admin permissions, which on Sentry SaaS is only the Owner role.
What this means in practice:
Okta SCIM can provision these roles only: Admin, Manager, Billing, and Member.
Attempting to provision a user as Owner via SCIM returns a
400error ("Invalid organization role").
To give someone the Owner role:
Provision them via Okta SCIM with an allowed role, such as Member.
In Sentry, go to Settings > Members, open that member, and manually assign the Owner role.
Once a user is an Owner, SCIM will not modify or downgrade their role, so the manual assignment is preserved.
If you want to group Owner accounts in Okta, create a group with no sentryOrgRole attribute defined. Without that attribute, SCIM won't override the members' roles, so you can group Owners without affecting their access.
For more detail, see the Okta SCIM provisioning documentation.