This article addresses the usage of the user status expression "status==Active" and/or "status==suspended" in group rules. Situations may arise where admins are looking to set up group rules using the Okta user status expressions, such as "status==Active" and/or "status==suspended" but are outputting values for users that do not match the rule.
- Group rules
This issue is caused by the expression validator that does not distinguish between the user's Okta status (except the Deactivated status).
This issue is being investigated, but for now, this form of expression should not be used in group rules.
While standard status expressions are currently invalid, use user.getInternalProperty("status") to achieve the desired result.
For example, to exclude suspended users, use: user.getInternalProperty("status") != "SUSPENDED"
Alternatively, admins can target specific attributes such as user.attribute1=="valueX" or a combination of attribute expressions and group expressions (isMemberOfGroup("groupId")
