This article provides guidance on common items to review when using Okta Identity Governance Access Requests, where a configured task assigned to Group Owner(s) becomes unassigned or is not assigned to all expected Group Owners.

In the case where the Requester is also a Group Owner that is set for the Task, resulting in a self-approval situation, also see Access Request Expected Reviewer Self-Attestation Behavior.

• Okta Identity Governance (OIG)
• Access Requests
• Request Types
• Resource Centric Access Requests (RCAR)

For Request Types

(Does not apply to RCAR requests, as Just In Time (JIT) logic is used for similar scenarios with RCAR)

1. For Group or Individual assigned as Group Owner:

   • Make sure the user(s) are assigned to the Okta Access Requests app.

2. If Group Owner is: Group assigned as Group Owner

   • If the owner of a group in Okta is another Okta group, this group must be pushed to Access Requests for it to be used as an approver.
     • Example: 

3. If Group Owner is: individual user(s) assigned

   •  If the User was recently added as "Individual" Group Owner and daily group sync has not occurred, perform a manual sync:

     1. Access Requests Console > Settings > Resources tab > Okta Groups > in the top right, click Update Now.

     2. Refresh the page and see if the "Last updated" value is updated.

     3. Try to create the request again.

For Request Types or RCAR

• Verify that the user(s) are assigned as Group Owner for the intended Group.

Functional Notes for Request Types and RCAR (Conditions/Sequences)

• Limit of 10 Random Users:
  • Be aware, as with the Okta Group selection, there is a limit of 10 "random" users that can be assigned as approvers when using Group Owner.
• Group Owner with People(individual) and Group Assignments:
  • If a group owner has both People(individual) and Group assignments, the users who are individually assigned as group owners will be assigned to the task.
    • Example: From the snippet below, users from MyHR in the Group are not assigned the task, but those assigned under People are assigned.

Related References

• How to See Addition/Removal of Group Owners via System Log Event 
• Access Requests
• Access Request Assignee Types
• Resource Centric Access Requests (RCAR)