@KarthikeyanP.72385 (Customer)​  - For a scenario like this there needs to be something that informs Workflows it needs to perform an action. Workflows has no means to directly interact with Active Directory so there is not going to be any direct prompt from AD that could trigger Workflows to execute.

This leaves only Okta-side as an option. What you need to determine is if there is any event that occurs (Even if the event is not event-hook-eligible) that identifies the user was added to the specific group. If the change is happening on the AD side then "replicating" to Okta it is most likely an Import type event. If you are able to locate a System Log event meeting this criteria then this use case is likely possible. If you can't then it is likely not possible.

Assuming you do find a specific System Log event that contains the information needed to identify the group change AND it is not event-hook-eligible a Workflow can be created on a schedule to check the Okta System Logs for an occurrence of that event allowing you to perform later actions. In this scenario you would do something along the lines of:

• Create a Workflow table with an initial ISO 8601 date stored
• Create a Workflow leveraging "Search System Logs" (Note: this requires okta.logs.read which is not on by default)
• The Search System logs can look for a specific event and you can set a Since/Until date range
• A NOW card can be utilized to get the "until" date and the table would be the "Since" date
• You would then as a last step update the table with the current "NOW" date to act as the new "Since" date the next time the schedule runs.

This would allow you to perpetual in as short as 5 minute intervals search the system logs for a specific event in a non-overlapping time frame. If anything is found then it can be passed to a Helper flow for processing.