Okta Automatically Assigns Applications to Groups with Admin Roles
Last Updated:
Overview
By design, Okta automatically assigns specific applications to groups when administrators assign administrator roles to those groups. This causes some applications to appear in the group overview counter but not under the group details. Administrators can verify these hidden applications by querying the System Log.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Groups
- Super Administrator Role
- Application Assignment
Cause
Solution
Why do applications appear in the group overview counter but not in the group details?
By design, Okta automatically assigns applications to groups when administrators assign administrator roles to those groups.
Review the group overview counter to see the total number of assigned applications.
The assigned applications vary depending on the specific administrator role.
Which specific applications appear in the counter when administrators assign the Super Administrator role to groups?
When administrators assign the Super Administrator role to groups, the applications that appear in the counter include Okta Admin Console, Okta Agent Registration, and, if available, Okta Workflows and Okta Workflows OAuth. On the Group settings page, navigating to the Applications tab reveals only two or zero applications.
Review the Applications tab to see the visible applications for the Super Administrator role.
Filter the System Log using a specific query to view the remaining hidden applications assigned to the group.
target.displayName eq "Super Administrators" and eventType eq "group.application_assignment.add"
The target.displayName value represents the name of the group.
How are Help Desk Administrator role applications verified?
When administrators assign the Help Desk Administrator role to groups, the application that appears in the counter is the Okta Admin Console. However, navigating to the Applications tab in the Group settings does not display the Okta Admin Console.
Review the Applications tab to see the visible applications for the Help Desk Administrator role.
Filter the System Log using a specific query to view the application assigned to the Help Desk Administrator group.
target.displayName eq "HelpDesk Administrators" and eventType eq "group.application_assignment.add"
Where target.displayName value is the name of the group.
The target.displayName value represents the name of the group.
NOTE: While administrators search for the Okta Admin Console and Okta Workflows applications in the Admin Console under Applications > Applications, Okta does not return the Okta Agent Registration app in the search results. For more information on this app, review the article linked in the Related References section.
NOTE: If the group creation date exceeds 90 days, the query does not return any details due to the Data Retention Policy.
