How to Select Zero Groups Connected to Okta in an AD Integration
Last Updated:
Overview
Any Active Directory (AD) Integration in Okta requires a selection for both User OUs connected to Okta and Group OUs connected to Okta. This is by design. However, some organizations may need to keep AD groups out of Okta altogether. This article will show two effective ways to prevent AD Groups from being imported to Okta.
Applies To
- Directories
- AD Groups
- Group Organizational Units (OUs)
Cause
Okta does not support leaving any Group OUs connected to Okta unchecked. This is by design. If attempting to save without any OUs selected, the following error is thrown:
Group OUs connected to Okta: The field cannot be left blank
Solution
Okta recommends choosing or creating an AD OU that will never house any AD groups as a workaround.
For example:
- Create an AD OU that will remain empty.
- Perform an import to Okta to refresh the AD topology.
- Go to Admin > Directory > Directory Integrations > [AD] > Provisioning > Integration.
- Find and select the newly created OU in the Group OUs connected to Okta.
- Verify that all other OUs in this section are unchecked, and click Save.
If the Okta Org uses the AD_LDAP_FILTER feature, alternatively, it is possible to create an LDAP Filter query that will not return any groups. For example:
(&(objectClass=group)(cn=There Is No Group))
- Click Save to commit the change. Remember that when the AD_LDAP_FILTER is enabled, a confirmation window will appear to verify the correct filter settings.
