<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-M74D8PB" height="0" width="0" style="display:none;visibility:hidden">
Loading
Skip to NavigationSkip to Main Content
System Status
Announcements
Announcements
Search
Search
Select Language
Knowledge Base
Knowledge Articles
Support Videos ↗
Documentation
Product Documentation ↗
Developer Documentation ↗
Product Release Notes ↗
Community
Events & Webinars
Okta Ideas ↗
Resources
Product Hub
Customer Success Hub
Product Release Update
Learning
Okta Learning ↗
Get Support
Open a Case
HomeCommunityForum
0D50Z00008G7VR5SANOkta Classic EngineAdministrationAnswered2018-09-05T01:28:28.000Z2017-09-21T15:47:18.000Z2017-09-21T15:47:18.000Z

RobinK.61708 (Customer) asked a question.

September 21, 2017 at 3:47 PM
Convert a group from AD mastered to Okta mastered?
In an effort to streamline our administration, we would like to only edit group memberships in Okta. We currently have a mix of Okta and AD mastered groups. Is it possible to convert our AD mastered groups to be Okta mastered instead?
  • 1 answer
  • 2K views

  • TheoC.70694 (Customer)

    Hi Robin,

     

    I’m not aware of a direct way to achieve this because AD-mastered group members can only be managed from AD. You could consider the following idea. It depends on factors like the number of groups involved, whether you need to sync Okta mastered group members back to AD and the long term plans. Create an Okta group for each AD synced group, using an identical group name (this is possible). Then for each group create a rule based on “if user is member of this AD group, make them a member of the same Okta group”. After the group rule is activated it populates the Okta group with the same members as the AD group. You can then assign the Okta group the same application as the AD group and remove the AD group (caution, I’ve not tested this part so you need to make sure application deprovisioning is not initiated). From that point, you’re able to manage the group members in Okta.

     

    In the future, you can continue to add group members from AD using manual methods or dynamic rules that can be based on attibutes that you set on the users in AD or are calculated using attribute transformation during mapping. Afterwards you can deactivate the rules, and even delete them making sure not to tick checkbox that removes members added to the Okta group. 

     

    Regards

     

    Theo
    Expand Post
This question is closed.
Loading
Convert a group from AD mastered to Okta mastered?