Hello @btc60 (btc60)​ 

Thank you for posting.Okta does not offer an official solution that performs as described. I recommend you to create an Idea for this feature: https://support.okta.com/help/s/article/Okta-Ideas-Step-by-Step-Guide?language=en_US

Regards

Henry E.

Okta Inc.

Hello Kishore,

This would be achievable utilizing Okta Workflows and building out a set of flows. The key condition for making stuff like this possible in Workflows is the eligibility of the events. See:

https://developer.okta.com/docs/reference/api/event-types/?q=event-hook-eligible

Since group.user_membership.add & group.user_membership.remove are eligible events you could create an Event Hook that monitors for those events and sends the payloads to an API endpoint (Workflows). You could then run flow logic to create a notification (Slack / Email etc..).

Since this would occur on every single group add/remove event. You could even add in logic inside the flow to only monitor for specific groups. If the "change" isn't a group you want to monitor just end the flow immediately.

Hello @TimL.58332 (Workflows)​  Thanks i was able to monitor the groups, but the request is a bit different for me

1. we have multiple groups, is there a way where we can monitor multiple groups in a single workflow and get an alert instead of configuring multiple workflows with multiple alerts
2. if the above doesn't work, is there a way where we can get scheduled alerts weekly, which gives us the detail who all have been added or removed from a group instead of on individual alerts

@btc60 (btc60)​ 

If you leverage an "Event Hook" and not a built-in "Okta Event" card you can have one hook and one endpoint to manage multiple event types. In Okta Workflows, create a new flow. In the "Event" column choose API Endpoint. Give the flow a name and save it. Then click the < / > icon on the card. Set it to a Webhook then copy the Invoke URL

In the Okta Admin UI under Workflows > Event Hooks you would create an event hook. Give it a name, and select the events (Group add/remove in your instance). In the URL field paste in the Invoke URL captured previously. This Event hook will monitor for both event types and pass the payload to the API Endpoint defined by the URL value. Then in the Workflow you can test (both add/remove) and pull the relevant data from the events and do something with it.

For the second question I would leverage a table. Depending on the size of your org getting alerts every time a user is added/removed could be very noisy. You could record the pertinent data to a table at the end of the flow in question. You could then have a second flow that runs daily or weekly that exports the table, sends the exported table as an attachment (or maybe uploads it to a "drive" service), and finally clears the table. Note: Tables are limited to 100k rows, so you need to ensure a peak usage <time frame> can't exceed the value.

Adding some screenshots as an example: Event hook configured to trigger on group add/remove. Delivers payload to API endpoint to start flow.

Each event is processed, if you are only looking for a specific group you can skip the "lookup" table. If you have multiple groups you want to evaluate you can list them in the lookup to evaluate if they exist in this specific processing pass.

Do more stuff.. is what ever you want to do with the data now that you have confirmed it is a data set you want to work with. You could "create an alert" or "write stuff out to a table" etc..

Yes. The email services cards have the option to include attachments. I believe all of them require a "list of files". So, for example if your outputted list of objects was processed via a "For Each" into a Helper flow to generate one row per object into a Table, then in the Parent flow exported the table it would be a CSV with a type (File). You could then move this output into a List -Construct card to have a new output of a "List of Files" which would be acceptable for the email cards.