A group push rule configured with a provisioning application fails to pick up newly created groups when a constrained administrator account creates them. To resolve this, assign the appropriate administrator role permissions for creating groups and managing applications, then recreate the affected groups. When a constrained Okta administrator account creates a new group, Okta generates the following error in the System Log:

Due to improper permissions from User <USER_ID> in creating GroupPushMapping(s) for UserGroup <USER_GROUP>, these GroupPushRule(s) have been skipped [grouppushruleid]

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Integration Network (OIN)
• Push Group by Rule
• Administrator Roles and Permissions

The administrator account possesses permission to create a new group but lacks the appropriate permissions to manage an application assignment as a consequence of the matching rule.

How are group push rule permission errors resolved?

Assign the appropriate administrator role permissions for creating groups and managing applications, verify dependencies, and recreate the affected groups by following these steps.

1. Add the appropriate administrator role permissions for both Create groups and Manage applications. This includes the standard roles Organization Administrator and Application Administrator,​​​​ or a custom role and resource set.
   Review the following image for an example of the Manage Applications permissions configuration.
   
2. Check for other dependencies to ensure their removal does not cause an issue.
3. Delete the recently created groups. NOTE: Contact Okta Support before deleting these recently created groups.
4. Recreate the groups using an administrator account with the appropriate permissions level.

Related References

• How to Create Custom Admin Roles
• Create a resource set
• About role permissions
• Can a Group Push By Rule Contain More than 100 Okta Groups
• Group Push Common Issues
• Push Group Rule is not Reevaluating Manually Removed Group