The Group Push functionality allows pushing existing Okta groups and their memberships to provisioning-enabled, third-party applications. These memberships are then sourced by Okta. Group Push adds groups to third-party apps, but it does not create groups in Okta.

• Group Push
• Provisioning

• Using the same Okta group for assignments and group push is not supported and may result in issues with no obvious error message. To maintain consistent group membership between Okta and the downstream app, a separate group must be created and configured to push groups to the target app.
• A pushed user must be active in Okta, assigned to the application, part of the Okta pushed group, and provisioned and active on the application side.
• Pushed groups should be managed only in Okta. Changing the group in the target app causes synchronization issues with Okta.
• Deactivated users are not included in Group Push updates, so their group memberships are not updated in the downstream app. To update these users, first reactivate the user in Okta. Then run Group Push again for each group the user belongs to.
• This process is always Okta sourced. Therefore, a group name that already exists within the target app cannot be pushed unless the app supports Group Linking.
• To push groups to Active Directory, the permissions to create groups in Active Directory is required.
• When a group is unlinked but not deleted, Okta does not send a call to convert it to an app group.
• The target group in the downstream application was deleted. Remove the Push Group from the app in Okta and then add it back as a Push Group to the app.
• If the desired target group is not found as a match when attempting to link to an existing group in the app, click the 'refresh app groups' button from the push groups tab of the application settings.

Related References

• Troubleshooting Group Push
• Group Push prerequisites
• About Group Push
• App assignments and Group Push
• How to Sync/Push Users from Okta to Active Directory