PhilipB.90063 (Customer) asked a question.
Pre-sync interval with workday/okta integration is throwing a constrained security group error
So presently our Workday is connected with 2 Okta instances for different parts of the company. For one of them it is working completely fine.
For the other, it is completely working EXCEPT for pre-sync interval. As long as pre-sync is blank, it works completely fine. As soon as we set it to any value, it immediately starts failing with this error from the knowledgebase:
This is actually something we're doing and didn't realize wasn't supported since it was working entirely? Is there anything we can do to get pre-sync working? I believe we are using it to limit to just the relevant users for that business unit.
Hi @PhilipB.90063 (Customer) , Thank you for reaching out to the Okta Community!
Unfortunately, this seems to be the current state of affairs.
The doc itself seems to be dated quite recently (last week), so there's slim chance things changed.
That being said, we do recommend checking with Workday Support to see what they have to say about this.
We'll also leave this Question open in case things change or anyone in the Community can provide a solution.
If my answers helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--------------------------------
Community members help others by clicking Like or Select as Best on responses. Try it today.
Thanks for the reply, Mihai. Our workday consultants insist it should work and has for many other customers, but yeah, we're sort of at a loss here. Literally everything but presync is working fine for us. We're mostly caught between at the moment. Any chance a support ticket instead of community could get assistance here?
```Nope, I can confirm that ISU has right set of permissions to pull active workers and prehires/future hires. Please see attached screenshot, according to WD recommendation another way to test security is using 3rd party application and launch Get Workers call (which is what OKTA is doing as well in background). You can see that I can a response back with data for CW 8853. I don't want us to spend anymore time on security as we can see that ISU is able to pull required data.
Now, for next steps I recommend that we open a support case with OKTA and look into this. They might just say that constrained group is something that doesn't work but we have examples of clients where this has been working for years. While we troubleshoot with product support team, I would also recommend we start considering other options as secondary plan.```
@PhilipB.90063 (Customer) It's worth a try. Perhaps the Support team can pull additional resources to review the matter and provide a definitive answer.
Thank you.