How to Check if a User Is a Member of a Specific Group in Okta Workflows

This how-to guide presents how to check if a user is a member of a specific group in Okta Workflows.

• Okta Workflows

A helper flow is one solution for checking if a user is in a group. This flow can be plugged into any other flow and reused.

NOTE: The Get Users Groups shown above evaluates a maximum of 200 groups due to API pagination limits. If a user belongs to more than 200 groups, the basic flow does not evaluate memberships beyond the initial 200 results. If the list of users in the target group contains fewer than 200 users, consider using the List Group Members card as an alternative.

The flow has the following steps:

1. The Helper Flow card has two inputs: User ID and Group name. They are used to check if the user entered is a member of the group entered.
2. The Okta – Get Users Groups card takes a User ID and returns all the groups this user is in
3. The List – Find card searches if the Group name input matches any of the groups in the list returned. It searches only the Profile.Name path in the group list JSON. A sample of the JSON is shown below. The item output field is the first item in the list that meets the specified criteria. The index output field is the location of the item in the original list
4. The Branching – Assign If card checks if the index is greater than zero. If greater than zero (a match was found), the return is true. If less than zero (a match was not found), the return is set to false.

   {
       "Last Membership Updated": "2023-05-25T18:36:20.000Z",
       "Last Updated": "2022-07-01T14:10:24.000Z",
       "Profile": {
         "Name": "No-code Automation",
         "Description": "A group with awesome people"
       }
       ...
     },
     {
       "Last Membership Updated": "2022-11-17T17:36:33.000Z",
       "Last Updated": "2022-06-24T19:32:06.000Z",
       "Profile": {
         "Name": "No-code Builders",
         "Description": "Folks who build automations"
       }
       ...
     }

This is a flow run where the group name is matched:

This is a run where the group name is not matched:

NOTE: In the above screenshot, the index in the List – Find card is -1. It indicates no match is found.