AD group membership does not update during full or incremental imports when the Do not import users - Skip users during import setting is active under Provisioning > To Okta. Clearing this setting allows Okta to update user memberships during imports.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Directories
• Active Directory (AD)
• Groups
• Group Membership

This is expected behavior. Okta imports groups when the Skip users during import setting is active, but Okta does not update group memberships until a user import completes via Just-in-Time (JIT) provisioning or Real-Time Sync.

How is the Okta Active Directory group membership updated during import?

To update group membership during Active Directory import, navigate to the Active Directory provisioning settings and clear the Skip users during import option.

1. Go to Provisioning > To Okta.
2. Clear the Do not import users - Skip users during import checkbox to allow Okta to process user updates during Incremental or Full Imports.

Related References

• Configure Active Directory import and account settings
• Configuring Real Time Sync: Okta Active Directory Integration