How to Check from which Group the User Inherits the Assignment for an Application in Okta

When an Okta user belongs to multiple groups assigned to the same application, they inherit the assignment options from the highest priority group. Determine which group handles the user's assignment by checking the user's assignment details in the Admin Console.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Group App Assignments
• User Administration

How is the group assignment inheritance determined for an Okta user?

When an application assignment occurs via a group, users inherit the assignment options from the group, such as licenses and roles. If the application includes multiple assigned groups and users belong to more than one group, they inherit the assignment options from the higher priority group.

For example, if an application includes four assigned groups with unique licenses, roles, or attribute values prioritized from Group 1 to Group 4:

• If a user belongs to Group 1 and Group 2, the user inherits the assignment options from Group 1 because it has a higher priority.
• If a user only belongs to Group 2, they inherit the assignment from Group 2 despite the lower priority.

NOTE: This logic applies to use cases that do not use the option to combine values across groups.

How is the inherited group assignment checked and overridden?

Assign groups to the application, set the group priorities, and view or override the inherited user assignment details in the Admin Console.

1. Assign groups to the application and configure the necessary attributes, roles, and licenses for each group.
   
   
2. Set the group priorities by dragging the dots on the left of the group to the correct order.
   
3. Navigate to the Assignments tab, select People on the left, and click the Edit (pencil icon) button next to the username.
   
4. View the group from which the user inherited the attributes, roles, or licenses at the bottom of the prompt.
   
5. Manually override the values by selecting the Administrator (overrides group) option at the top of the prompt.
   
6. Enter the new values to override the inherited group attribute values.