This article explains why group memberships are not pushed to Active Directory (AD) when a staged user is created in Okta. It clarifies the expected behavior regarding group membership synchronization for users who have not yet reached an active status.

• Active Directory (AD)
• Group Push
• Staged Users
• Okta Classic Engine
• Okta Identity Engine (OIE)

Okta only pushes group membership updates to AD for users who are active and have an active AD application assignment. Because staged users are not yet active, group memberships are not synchronized to the downstream directory.

To ensure group memberships are pushed to AD, the user must be activated within Okta. Once the user's status changes from Staged to Active and they have an active AD application assignment, group memberships will synchronize as expected.

For further details, refer to the documentation regarding Provisioning Staged Okta Users to Active Directory.