NOTE: This article no longer applies to the Google Workspace OIN app and the Org2Org OIN app found in Okta OIN App Catalog since the Okta Production v2025.07.0 release.
An application integration was configured with the provisioning API enabled on the Okta tenant org, and the Push Groups were configured into the Application.
- In the API integration, the Import Groups option was disabled from the Provisioning > Integration tab.
- However, by clicking on the Refresh App Groups button on the Push Groups tab, all application groups have been added/imported into Okta.
- Clicking on Refresh App Groups triggers the app group import creation into Okta despite the Import Groups option being disabled in the API integration.
This article clarifies whether this is an expected behavior.
- API Integration
- Import Groups
- Push groups
- Refresh App Groups
- All applications that support Group Linking, excluding Google Workspace OIN and Org2Org OIN app
As of Okta Production v2025.07.0 release, the Okta product behavior for Google Workspace OIN and Org2Org OIN application has been changed so that Refresh App Groups will no longer be able to import any application groups into Okta unless the Import Groups checkbox is checked/enabled within the same application. For more details, please read the Refresh App Groups does not work unless Import Group is enabled for Google Workspace or Org2Org OIN app only article.
For all other applications offering application import and group push linking functionality, the Refresh App Groups button on the Push Groups tab is designed to work independently (without Import Group dependency check) to perform manual app groups import (specifically requested by the Okta Admin user), which is required for the "Push Group Linkings" feature to work. It is normal and expected that clicking on the Refresh App Groups on the Push Group tab will trigger a refreshing app groups import of the groups, even if the Import Groups option is not selected in the Provisioning > Integration tab of the application, and has a System Logs event recorded. Use the following query to search in the System Logs for the event:
eventType eq "system.import.group.start"
This Refresh App Groups option is only relevant to applications that support Group Push Linking, as the Refresh App Groups ensures that all groups from the target app are represented in Okta.
NOTE: If it is required to delete the unwanted groups imported to Okta due to accidental clicking of the Refresh App Groups button, use the Okta API to do so. For full details, please refer to the article How to bulk delete Groups via Postman for the detailed steps.
