Removing Unnecessary Active Directory Groups from Okta

Active Directory (AD) groups which have previously been imported to Okta may no longer be necessary, or may have been accidentally imported.

This article discusses the removal options available to Admins if these AD groups are not necessary for Okta to import, and the potential impact of removing the groups.

• Active Directory (AD)
• Groups
• Imports

If a group has been imported to Okta from AD, it is because it is included in the Group OUs connected to Okta. If the Okta Admin chooses all default settings when configuring an Active Directory integration, the Groups in scope will comprise the entire AD domain.

NOTE: By default, "Builtin" Groups are not imported. This includes pre-configured Microsoft Security Groups such as the Account Operators and Pre Windows 2000 Compatibility Access groups.

If a group is no longer necessary in Okta, it may be safely removed without any negative impact on the Org, as long as there are no Group Rules or Application Assignments tied to it.

• All users that are members of the group will be unassigned from the group at the time of group removal.
• If the group is part of any Group Rule, and if that Group Rule is active at the time of group removal, the users assigned to those groups will be unassigned from the group rule's target.
• Likewise, if the group has any Application Assignment at the time of group removal, the users, once assigned to those groups, will be unassigned from the application.

Any Active Directory group that is not involved in any Group Rule and is not assigned any Applications may be safely removed.

To remove Groups from Okta scope, please perform one or both options: 

1. Reduce the OUs listed in Group OUs connected to Okta.
2. 1. Navigate to Admin > Directory > Directory Integrations > Active Directory > Provisioning > Integration.
   2. In the Import Settings section, find the Group OUs connected to Okta. If the entire domain is not visible, click Show more.
      • Any folder icon with a blue checkmark  next to it will automatically select all children. As an example, if the root domain has a blue check, all OUs and Containers listed therein will be included.

1. 3. To reduce the selection, uncheck the parent OU. The next level of checkmarks will turn blue. Uncheck any which are not desired for import.
   4. When finished, click Save.

The next full import will remove any groups which were previously imported.

2. Use an LDAP Search Filter

If the domain is large, the amount of checking and unchecking may seem unreasonable. In these cases, Okta Support can enable a feature to use a custom LDAP search filter during import or JIT.

NOTE: There are some important caveats to consider. Any potential LDAP filter must be tested thoroughly in the domain before entering Okta so that necessary groups are not accidentally removed. Any LDAP search filter is performed on each individual OU with a blue checkmark. If 100 Group OUs are individually selected, the query will be performed 100 times, once for each OU. This can cause connection timeouts if the domain controller does not respond within the allotted time for the action. Okta Support recommends keeping the fewest OUs checked at the highest possible level to limit the number of queries Okta performs on the domain.

1. 1. Please create a Support case to have this feature enabled. If the feature is already enabled, skip to step 2.
   2. Create a custom LDAP query that will import only the groups which match the query.
      • Okta Support cannot assist with creating LDAP queries, but there are many helpful guides:
        • Microsoft - Search Filter Syntax
        • LDAP.com - LDAP Filters
        • Atlassian - How to write LDAP search filters
   3. Navigate to Directory > Directory Integrations > Active Directory > Provisioning > Integration.
   4. In the Import Settings section, input the group search filter in the Group Filter field.
   5. When finished, click Save.
   6. When the LDAP filter feature is enabled, a confirmation is required that the LDAP filter has been reviewed and is correct. Check the box and click Save.