This article addresses the current limitations of configuring Identity Provider (IdP) Routing Rules in Okta based on group membership. While direct group membership matching is not currently possible, a workaround is presented below involving user attributes.

• IdP Routing Rules based on group membership
• Identity Management

In the existing Okta system, IdP Routing Rules are triggered during the authentication flow. However, at this stage, the user's group memberships are not recognized, preventing the direct application of group-based routing rules.

While Okta currently does not support direct group membership matching in IdP Routing Rules, use the following workaround with user attributes:

1. Configure a group rule to assign users with a specific attribute value to a group.
2. Edit the routing rule to match the user attribute and its value.
   • For instance, users with the "Title" attribute set to "Manager" get assigned to the "Managers" group. Adjust the routing rule so that it matches the "User attribute, Title Equals Manager" condition. Although there is no direct connection between the "Managers" group and the Routing Rule, all users with the "Manager" title who also belong to the "Managers" group will be routed accordingly.

Related References

• How to Create a Group Rule
• Configure identity provider routing rules