Okta Does Not Show Cross-Domain Membership for Domain Local Active Directory Groups
Last Updated:
Overview
When Okta imports Domain Local Active Directory (AD) groups, the groups do not show members from other domains because Okta does not support syncing Domain Local AD group membership from domains other than the group's own domain. To align with best practices, assign domain local groups to local resources and ensure they contain Global Scope groups rather than direct members from another domain.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Directories
- Active Directory (AD)
- Domain Local Groups
Cause
Okta does not support syncing Domain Local AD group membership from domains other than the group's own domain.
Solution
What configuration resolves cross-domain membership limitations for Domain Local Active Directory groups?
According to Microsoft's best practices regarding when to use groups with domain local scope, administrators should assign domain local groups to local resources, and these groups should contain groups with a Global Scope rather than direct members from another domain.
