Create an Okta Group Rule to Assign or Exclude Users
Last Updated:
Overview
Administrators can create Okta group rules to assign or exclude users from groups based on basic conditions or the Okta Expression Language (OEL). Map attributes from external sources, such as Workday or Active Directory, to Okta user profile attributes before evaluating them in a group rule.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Universal Directory
- Group Rules
- User Access Management
Solution
What are the steps to create an Okta group rule?
Create a group rule in the Okta Admin Console by defining the rule conditions, assigning the target groups, and specifying any user exclusions as detailed in either the video demonstration or the written instructions.
- Navigate to Directory > Groups in the Okta Admin Console.
- Select the Rules tab.
- Select Add Rule.
- Enter a Name for the rule.
- Select an IF condition. Basic conditions allow for simple rules based on string attributes, while the Okta Expression Language allows for custom expressions and more complex rules based on attributes and groups.
- Select the group or groups to assign the user to in the THEN Assign to field if the rule condition is met. A maximum of 100 groups can be assigned to a user.
- Enter the names of any users to exclude from the rule in the EXCEPT The following users field. A maximum of 100 users can be excluded from a rule.
- Select Save to create the rule.
The rule remains inactive by default. Administrators must activate the rule to apply it to the entire organization. Okta evaluates the rule for a user when an import, direct update, or other change updates the user profile. Okta does not evaluate rules for users in a Pending or Inactive state.
How is the Okta Expression Language used in group rules?
Administrators can use the Okta Expression Language (OEL) to create custom expressions within a group rule to refine conditions and reference multiple attributes.
Review the Expressions in group rules documentation for additional information about the Okta Expression Language.
Group rule conditions have several constraints. Expressions must use the Okta Expression Language, adhere to valid syntax while using logical operators, evaluate to a Boolean, and omit the assignment (=) operator. Expressions can only refer to available Okta user attributes, as Okta does not support application attributes in group rules.
The Okta Expression Language supports most functions, such as Boolean operators (AND, OR, !), arithmetic operators (<, >, <=, >=), and equality checks (==).
Okta group rule expressions restrict specific function categories to ensure optimal performance and maintain the simplicity of evaluating group membership rules across large user bases. Okta does not support the following function categories when creating these expressions:
- Convert: Functions that handle data type transformations, such as converting strings to numbers.
- Array: Functions designed to operate on collections of data, such as checking for element existence or filtering arrays.
- Time: Functions dealing with date and time manipulations or comparisons.
For scenarios requiring these operations, manipulate user or profile attributes before the group rule evaluation or consider alternative Okta features for group assignment.
