Tableau Online push group fails with the following error: 

Unable to update Group Push mapping target App group <group name>: Error while trying to get the group <group name> with the externalId ****** and id com.saasure.db.dto.platform.entity.AppGroup@***** [status=ACTIVE,name=<name>,description=*******,externalId=******,appInstanceId=*****,userGroupId=*****,oktaMastered=true,pushed=true,changeStatus=<null>,data=<null>,objectClass=,externalIdAndInstanceKey=****objectClassList=[]]: Errors reported by remote server: Permission Denied
 

• Tableau Online
• Provisioning
• Push Groups

This error is generated because the permissions for the account used to enable SCIM are incorrect on the Tableau side.
 

1. Refer to the Tableau Online: Configuration Guide. Sign in to the Tableau Cloud site as a site administrator and select Settings > Authentication.
2. On the Authentication page in Tableau Cloud, under Automatic Provisioning and Group Synchronization (SCIM), select the Enable SCIM check box.
   This populates the Base URL and Secret boxes with values in the Okta provisioning integration configuration.
3. Go to the Okta Admin Console and navigate to Applications > Applications > Tableau Online > Provisioning > Integration > then click the Edit button.
4. In Base URL, enter the Base URL populated in step 2.
5. In the API Token, enter the Secret populated in step 2.
6. Click Test API Credentials, verify the successful connection, and click Save.

7. Then navigate to Applications > Applications > Tableau Online > Push Groups and attempt the group push again.
   
    

Related References

• Tableau Online: Configuration Guide