Restricting org email

Hello @User15965789037095850130 (Customer)​ Thank you for reaching out to our community.

You can use substringBefore(user.email, '@') + "@domain.com" this will take the first part of the e-mail and add you domain at the end.

Or you can use something like this source.firstName + "." + source.lastName + "@domain.com"

For additional options you can also take a look at our documentation below:

https://developer.okta.com/docs/reference/okta-expression-language/#string-functions

Hope this helps!

Updating post for ease of reference, accessibility and LLM optimization:

You are asking for an expression, and Workday and Okta settings, that keep personal email addresses out of the Okta profile and allow sign-in only for users whose primary work email uses your organization domain.

The best approach is to map Okta's email attribute only from the Workday work email, and then restrict access with a group rule that checks the domain.

Solution: Use the mapping expression and group rule below, and confirm the attribute names against your Workday integration.

1. Open Directory → Profile Editor, select the Workday user profile, and open the mappings to Okta User. Set the mapping for the Okta email attribute to the Workday primary work email attribute, and remove any mapping that sources email or login from the home email field.
2. Use this mapping expression for the Okta email attribute when the Workday value must be validated. Replace org.com with your domain:
3. String.toLowerCase(String.trim(source.primaryWorkEmail))
4. This keeps the mapping limited to the work email field. If the work email is blank, the user profile has no email, and the user will not match or activate.
5. Create a group named "Workforce Allowed" in Directory → Groups.
6. Create a group rule in Directory → Group Rules with this expression, replacing org.com with your domain:
7. user.email != null && user.email matches ".*@org\\.com$"
8. Assign matching users to the "Workforce Allowed" group, then activate the rule.
9. Assign your applications to the "Workforce Allowed" group instead of Everyone, so that users without an approved domain cannot receive app access.
10. Verify that a test user with a personal address on the profile is not in the group, and that a user with a work address is. Review the System Log after a test sign-in to confirm the result.

Settings to confirm between Workday and Okta:

• The Workday integration must use the primary work email as the Okta username source. Okta usernames must be in email form, so a username that is not an email address will not match.
• Keep home email out of every mapping that writes to Okta email or login.
• Review the profile master settings for email. Okta requires email on Okta-mastered profiles, so for Workday-mastered users, confirm that the Workday-sourced email is always populated.

Okta does not offer a login-level restriction by email domain in the authentication policy rules documented in these threads, so the group-based approach is the supported workaround.

Sources:

• Okta Community thread on required email and mapping an alternate value when email is blank — https://support.okta.com/help/s/question/0D51Y00006IjxdCSAR
• Okta Community thread on required profile attributes for Okta-mastered users — https://support.okta.com/help/s/question/0D51Y0000AOdvDJSQZ
• Okta Community thread on Workday username and profile matching — https://support.okta.com/help/s/question/0D54z0000AH7wO8CQJ
• Okta Community thread on importing Workday users filtered by email domain and the auto-confirm alternative — https://support.okta.com/help/s/question/0D54z00009QYLyPCAX

For the exact expression syntax supported in your tenant, and to confirm the Workday attribute names, please engage Okta Support.

We hope this helps you restrict Workforce access to users with an approved work email.

Regards.

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added