Best Practices for Bulk Updating Google Workspace App Usernames in Okta

Updating the application username format to a custom Okta Expression Language (OEL) expression allows administrators to safely bulk update Google Workspace app usernames to a new verified domain without triggering account deactivation or recreation. This method is utilized when a separate Google Workspace application is configured for Security Assertion Markup Language (SAML) Single Sign-On (SSO), and the Okta user email domain remains unchanged. When manual admin overrides are used to edit application assignments, this causes the deactivation of old accounts and the creation of duplicate accounts in Google Workspace.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Google Workspace Provisioning
• Okta Integration Network (OIN)

How can Google Workspace app usernames be updated in bulk safely?

Configure the application username format with a custom OEL expression and apply the update to all existing users by following these steps.

1. Navigate to the Google Workspace provisioning application in the Okta Admin Console.
2. Select the Sign On tab.
3. Change the Application username format from Email to Custom.
4. Enter the following OEL expression, replacing <yourNewDomain.com> with the new verified domain:

String.substringBefore(user.email,"@") + "@<yourNewDomain.com>"

5. Run an expression mapping preview with a currently assigned user to ensure the expected new domain email address value is generated.

The expression mapping preview validates that the custom expression correctly generates the new domain email address.

6. Ensure the Update application username on is set to Create and update.
7. Click Save. All new Google Workspace application assignments automatically use the new application username format.
8. Refresh the page to display the Update Now button for pre-existing application assignments.

The application settings page displays the update button required to push the new username format to existing users.

9. Click Update Now.
10. Verify the updates by checking the Okta System Log for Application property updated and Push profile update events.
11. Navigate to the Google Workspace Edit App Assignment page to confirm that both the App username and App user external ID fields reflect the new email domain address value.

The application assignment page confirms that the application username and external ID fields have been successfully updated to the new domain.

12. Confirm in the Google Workspace platform that the user account remains active without duplicate creation and that the username reflects the new email domain address.

The Google Workspace admin console verifies that the user account remains active and reflects the newly updated email domain.