When running an Access Certifications Resource Campaign that has an Active Directory (AD)-sourced group as a resource, and after revoking access, the user was not removed from the AD Group, with the Campaign Summary showing Manual Remediation, and with the following error:

The user could not be automatically removed from this group in the source because the agent did not have sufficient permissions to execute the action.

The same root cause may apply if attempting the removal via an API call using /api/v1/directories/{appInstanceId}/groups/modify from the Directories Integration documentation, and the response is similar to: 

 "body": {
    "errorCode": "E0000006",
    "errorSummary": "You do not have permission to perform the requested action",
    "errorLink": "E0000006",
    "errorId": "oaecDQwp03zTo-AT6Jp1eCFhw",
    "errorCauses": []
  },
  "message": "403 Forbidden",

Error: System.UnauthorizedAccessException: Access is denied. at System.DirectoryServices.Interop.UnsafeNativeMethods.IAds.SetInfo() at System.DirectoryServices.DirectoryEntry.CommitChanges() at Okta.DirectoryServices.ActiveDirectoryAdapter.ProcessMemberInLoop(String path, WriteAttribute property) updating membership for user: <GUID=USERGADUIDHERE> group: LDAP://DOMAIN.TLD/<GUID=GROUPADGUID> action: REMOVE

• Okta Identity Governance (OIG)
• Access Certification Resource Campaign
• Campaign Remediation with AD Bidirectional Group Management

The AD Agent does not have the needed permissions in AD to remove the user(s) from the group. This may occur if Push Groups are not leveraged with the AD Integration.

In order for this to work, the service account used for the Okta AD Agent needs to have its permissions set to the items under the Group Push functionality section at Okta service account permissions:

• Requires Create Child permissions for group objects on the target OU.
• Requires Delete Child permissions for group objects on the target OU.
• Requires Write Property permissions on group objects within the target OU for the following attributes:
  • sAMAccountName
  • description
  • groupType
  • member
  • cn
  • name

Related References

• Bidirectional Group Management with Active Directory
• Reviewers may still need to remediate access manually with AD Groups, with scenarios listed at Use Okta Access Certifications to manage AD group membership
• Create resource campaigns
• Directories integration