Okta Google Workspace Provisioning Fails With SKU Conflict During Automated Group Rule License Swaps
Last Updated:
Overview
An SKU conflict error occurs during automated provisioning between Okta and Google Workspace when a user's license changes via Okta Group Rules. This occurs because Okta evaluates Group Rules and pushes Application Programming Interface (API) calls non-atomically, leading to a race condition in which Google processes the new license assignment before It successfully strips the previous license. Resolve this issue by utilizing Okta Workflows to orchestrate a sequenced provisioning flow or by manually clearing and reassigning the user in the Okta Admin Console. When a single-cycle group rule execution simultaneously removes a user from an old group and adds them to a new group, Google Workspace rejects the new license assignment, and Okta generates the following error:
User already has a license of the product, but with a different SKU. To reassign a new SKU for this product, use the 'update' operation.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Google Workspace Provisioning
- Okta Group Rules
- License Management
Cause
An architectural limitation and race condition resulting from eventual consistency on the Google API side causes this issue. When an Okta Group Rule triggers a simultaneous group switch, Okta processes the removal from the old group and the addition to the new group non-atomically within the same execution cycle. Because these API calls are non-atomic and Google takes time to sync updates, the assignment call for the new SKU often reaches Google before Google completely removes the previous SKU. This out-of-order execution results in an app.google.license_management.error.assign_license failure because a user cannot possess two distinct SKUs for the same product concurrently.
Solution
How is the Google Workspace SKU conflict resolved?
Okta requires stripping the existing license from the user record before pushing the new license assignment to Google Workspace. Since the automated Okta Group Rules process adds and removes groups simultaneously in a single cycle, Okta requires a delayed or multi-step execution model to allow the Google API sufficient time to process the removal. Utilize Okta Workflows to orchestrate a sequenced provisioning flow that explicitly removes the old license group, pauses for the Google API to update, and then applies the new group assignment.
Manually remediate the record for users currently impacted by this failed state by navigating to the Google Workspace application in the Okta Admin Console, clearing the user assignment, and reassigning the user with the correct group and SKU.
- Navigate to the Google Workspace application in the Okta Admin Console.
- Select the Assignments tab.
- Clear the user assignment to strip the stuck license.
- Reassign the user to the application with the correct group and SKU.
