User15907683515234673889 (Customer) asked a question.
Assigned Applications Questions... (Migration from Manually assigning per user to using Synched AD Groups)
I am trying to standardize our apps in OKTA by using AD groups rather than assigning apps per user.
We have 2 apps let's call them APP1 & APP2.
We have a single AD Group called "ADGroup1"
Work Done
- I have created an "ADgroup1",
- Made sure the group synced to OKTA and then
- Assigned the 2 apps to the group.
- I then populated the group with all the same members that had the app assigned to them manually.
- I then removed the manually assigned app in OKTA from one of the users using the "X". Typically you can't click the "X" if the user is getting the app from AD Group.
- When I check their profile it is not showing that the user it has the assigned app.
- I have waited around 45min - 1hr. I went and checked
- I have searched the AD group in OKTA and verified the user is in the group, however in the profile the user doesn't seem to see the apps I have assigned to "ADGroup1" in OKTA.
- I added a new person to the AD Group and the application shows up fairly quickly in OKTA as expected.
Questions:
Did I do anything wrong? (ie out of order)
What process would be able to "force" the application to the user?
Hi @User15907683515234673889 (Customer) , Thank you for reaching out to the Okta Community!
If we're talking about apps that have Provisioning enabled and users that were previously assigned individually, you have the option to convert the assignment to group or vice-versa.
You can handle this individually by going to the App's menu in the Okta Admin Dashboard, clicking the Edit (pencil) button then under "Assignment master" select "Group" or "Administrator (overrides group)".
On the App's menu you also have the option called "Convert Assignments". This will allow you to manage things in bulk.
That being said, in your case now you'll have to re-assign the Group(s) to ensure the assignment to all the involved users.
⚠️ PLEASE NOTE: Before you do so, ensure that you temporarily disable the "Deactivate Users" feature (if available) under the app's Provisioning→ To App section, to avoid any unwanted account deprovisioning.
Article for reference:
https://help.okta.com/en/prod/Content/Topics/Apps/apps-convert-to-group-managed.htm#:~:text=Select%20the%20Assignments%20tab.,Yes%20to%20confirm%20the%20change.
Hope it helps!
Thanks this worked perfectly! I appreciate your quick response!
Great! Happy to help! 😁
Please consider marking the answer as "Best" to increase visibility for others that might encounter this situation.
Have a great rest of the week!