When a group is assigned to an Active Directory (AD) integration in Okta for user provisioning, the target organizational unit (OU) is stored in the group's profile and can be accessed via the API. A GET request to the Okta API retrieves the organizationalUnit attribute, which contains the distinguished name (DN) of the targeted AD OU.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory Integration
• Group Assignment
• User Provisioning

How Is the Target AD OU Retrieved for an Okta Assignment Group?

Make a GET request to the Okta API targeting the Active Directory application instance and the specific Okta group ID to retrieve the target AD OU.

1. Make the following GET request, replacing the placeholders with the appropriate values:

GET https://{yourOktaDomain}/api/v1/apps/{adAppId}/groups/{oktaGroupId}

• {yourOktaDomain}: The Okta domain for the organization.
• {adAppId}: The unique ID of the Active Directory integration. Locate this ID by listing apps via GET /api/v1/apps or by checking the URL string when viewing the directory in the Okta Admin Console.
• {oktaGroupId}: The ID of the Okta group being checked.

2. If the group is assigned to the AD integration for user provisioning, the response JSON contains a profile object. Locate the organizationalUnit attribute inside this object — it stores the distinguished name (DN) of the targeted AD OU.

Related References

• Configuring Postman for Okta API Access