Provision Okta Users to a Specific Active Directory Organizational Unit
Apr 15, 2026
Okta Integration Network
Okta Classic Engine
Directories
Okta Identity Engine
Overview
To provision Okta users to a specific Active Directory (AD) Organizational Unit (OU), configure Okta-sourced groups as provisioning groups to use Managed Directories.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Active Directory (AD)
- Organizational Unit (OU)
- Directories
- Okta-Sourced Groups
- Managed Directories
- Provisioning Users
Solution
How are Okta users provisioned to a specific Active Directory Organizational Unit?
To provision Okta users to a specific Active Directory OU, verify the directory integration settings, enable user creation, and configure the group directories as described in the video and steps below:
To prevent unexpected behavior, use an Okta group that is not configured as a Push Group. A group should not be configured as both a provisioning group and a Push Group.
For Okta to create users in an OU, that OU must be selected in User OUs connected to Okta.
- Navigate to Directory > Directory Integrations > [AD] > Provisioning > Integration.
- Verify that the OU targeted for provisioning is selected under User OUs connected to Okta.
The Create Users option must be enabled in the AD instance.
- Navigate to Directory > Directory Integrations > [AD] > Provisioning > To App.
- Verify that Create Users is selected.
Configure an Okta group for provisioning to AD.
- Navigate to Directory > Groups.
- Create a new group in Okta or select an existing Okta group.
- Add the desired Okta users to the selected group.
- Open the group in Okta, select the Directories tab, and choose Manage Directories.
- Select one or more AD integrations from the Not Members pane on the left to add them to the Members pane on the right.
- Select Next.
- Choose the specific OU to push users for each AD integration. Select Show More under Default Attributes > Organizational Unit and locate the correct OU. Select only one OU per AD integration.
- Optionally, configure any custom attribute fields that each AD user profile shares while in the group.
- Select Confirm changes.
NOTE:
- Active Directory profiles are created or updated for all group members. When adding new users to the group, Okta automatically pushes these profiles to the directory.
- The service account utilized by the Okta AD Agent requires Domain Admin privileges or the necessary permissions to create and update users in Active Directory.
