Explanation of Non-IdP Managed User Group Membership Removals in Okta
Last Updated:
Overview
Okta removes users from Okta groups during Inbound Security Assertion Markup Language (SAML) Just-In-Time (JIT) provisioning if those groups are absent from the SAML assertion during a full sync. This occurs because the Full sync of groups setting enforces strict membership matching. Administrators must change the Group Assignments setting to Add user to missing groups or use Group Rules to prevent Okta from removing users from existing groups.
Applies To
- Okta Classic Engine
- Okta Identity Engine (OIE)
- Inbound Security Assertion Markup Language (SAML)
- Just-In-Time (JIT) Provisioning
Cause
The Full sync of groups setting in the SAML Identity Provider (IdP) configuration enforces strict membership matching. If the SAML assertion does not include a specific group, Okta removes the user from that group to ensure the Okta profile matches the IdP assertion.
Solution
How do administrators prevent Okta from removing users from groups during JIT provisioning?
Navigate to the Identity Providers page in the Admin Console and change the Group Assignments setting to Add to ensure Okta adds users to groups without removing them from existing memberships.
- Navigate to Security and select Identity Providers.
- Locate the specific SAML IdP, select Actions, and choose Configure Identity Provider.
- Select Edit and locate the Group Assignments section.
- Choose Add user to missing groups instead of Full sync of groups.
- Select Save.
Review the following image for an example of the Group Assignments setting configured to the Add user to missing groups option.
NOTE: The Add user to missing groups option prevents the removal of users from groups.
Administrators Can Use Group Rules to Manage Groups Without Direct IdP Assignment
Set the Group Assignments attribute to None within the IdP configuration and create a Group Rule to automatically assign users to the desired Okta groups based on their attributes.
- Set the Group Assignments attribute to None within the IdP configuration.
- Navigate to Directory, select Groups, and choose Rules.
- Create a Group Rule to automatically assign users to the desired Okta groups based on their attributes.
