How to Create Group Rule Using Additional Active Directory Attributes
Aug 28, 2025
Lifecycle Management
Okta Classic Engine
Okta Identity Engine
Overview
This article provides instructions on how to use an Active Directory (AD) attribute within an Okta Group Rule by using the Okta Expression Language.
Applies To
- User Lifecycle Management (LCM)
- Okta Identity Engine (OIE)
- Okta Classic Engine
Solution
Follow the instructions below to configure a Group Rule's If condition to use an AD attribute. For more details on setting up Group Rules, see Create group rules.
- In the Group Rule
Ifcondition, select Use Okta Expression Language (advanced). - Enter the expression in the following format, replacing
<AttributeName>and<AttributeValue>with the appropriate values:
findDirectoryUser().<AttributeName> == "<AttributeValue>"
- NOTE: This expression only functions correctly if a user has exactly one Active Directory assignment. The
findDirectoryUser()function returns null if the user has more than one or zero AD assignments.
For more information, refer to the Okta Expression Language Directory and Workday functions documentation.
