Okta Org2Org App Push Group Fails With Error While Updating User Group Membership
Last Updated:
Overview
An Okta Org2Org application group push fails with a group membership update error because some users in the group are not successfully provisioned in the target organization. Resolving the provisioning errors for the affected users in the source organization allows the group push to succeed. Okta generates the following error in the System Log:
Unable to update Group Push mapping target App group <group name>: Error while updating user group membership for group <group name>: One or more errors occurred during update group membership.
FAILURE: This operation is not allowed in the user’s current status.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Org2Org Application
- Provisioning
- Group Push
Cause
This error occurs when some users in the affected group are not successfully provisioned in the target Okta organization. This inconsistency often happens if users are deactivated in the target Okta organization while remaining active in the source Okta organization.
Solution
How is the Org2Org group push error resolved?
Identify users with provisioning errors in the source Okta organization, resolve them to ensure successful provisioning in the target organization, and retry the group push.
- Navigate to the source Okta Admin Console and go to Dashboard > Tasks.
- Locate the users with errors under Profile push updates encountered errors or Application assignments encountered errors for the Org2Org application.
The following image displays the Tasks page where administrators locate provisioning errors.
- Resolve the provisioning errors for all users who are members of the affected push group.
- Verify the user status in both the source and target Okta organizations to ensure there are no inconsistencies, such as a user being active in the source organization but deactivated in the target organization.
- Navigate to Applications > Applications and select the Org2Org application.
- Select the Push Groups tab and retry the group push.
The following image displays the Push Groups tab where administrators retry the group push.
