In certain cases, exceptions can be generated and added to the "exception list" by group rules.

• Group Rules
• Universal Directory
• Group Rule Exceptions

The addition of exceptions to group rules can occur in the following situations:

• When a user is manually removed from the group

Should a user be manually removed from the group, an exception will be automatically recorded for that user under the relevant group rule.

• When a user is manually added to the group

If a user is added to a group but does not meet the standard criteria for triggering the group rule, an exception can be added to ensure that the user is not subsequently removed from the group as a result of the rule.

• When a user is manually added to the exception list

If a user needs to bypass a specific group rule for a valid reason, they can be added to the exception list by modifying the group rule and including the user via the edit rule interface.

NOTE: During inbound SAML synchronization from an external IdP, if the Okta IdP configuration has Group Assignments set to Full sync of groups, any modifications to groups that are either conditions or targets within an Okta group rule will lead to the associated users being added to the exception list.