When pushing groups from Okta to Google Workspace, the following error may be encountered:

Unable to update Group Push mapping target App group group_name_over_64_characters: Failed to create group {group_name}. Invalid Input: groupKey

• Google Workspace
• System for Cross-domain Identity Management (SCIM)
• Group Push
• Okta Classic Engine
• Okta Identity Engine (OIE)

The error Invalid Input: groupKey when pushing a group from Okta to Google Workspace indicates that the group’s name or the resulting email address for that group does not meet Google’s requirements. The groupKey is what Google Workspace uses to uniquely identify a group, and it’s directly tied to the group’s email address.

This error is typically caused by one of the following issues:

• Character Limit Exceeded: While Google Workspace allows a group name to be up to 73 characters, the groupKey (the group’s email address) is limited to 64 characters. If the group name pushed from Okta exceeds 64 characters, provisioning will fail with the Invalid Input: groupKey error.
• Invalid Characters in the Group Name: Google Workspace has strict rules for the characters that can be used in a group’s email address. Since the group name from Okta is used to generate this email address, any unsupported characters in the name will cause the push to fail.
  According to Google’s naming conventions, the following characters are not allowed in a group’s email address and therefore should not be in the group’s name when pushed from Okta:
  • Use names that make it easy to identify the group's purpose.
  • Can be up to 73 characters.
  • Use no more than 64 characters before the at sign (@) in a group email address.
  • For groups created in the Google Admin console, do not use an equal sign (=), angle bracket (<), (>), or ampersand (&).

• Shorten the group name in Okta to be 64 characters or fewer.
• Remove any of the special characters listed above from the group’s name in Okta.

Related References

• Name guidelines for users and groups