understanding SYNC behavior for Org units (Okta <-> Google)

Hi @SurajB.69263 (Customer)​ , Thank you for reaching out to the Okta Community! 

The core issue is that Okta's provisioning model is unidirectional by default: Okta pushes attributes to Google Workspace, not the other way around. When you make OU changes directly in Google Workspace, those changes are not automatically synced back to Okta. If Okta then performs a provisioning sync (either scheduled or manual), it will push the OU value stored in Okta's user profile back to Google Workspace, overwriting any changes you made directly in Google.

Root Cause:

Okta provisioning is designed as a push-only mechanism. The Google Workspace app in Okta's catalog provisions users and attributes from Okta to Google Workspace using SCIM. By default, Okta does not import or monitor changes made directly in Google Workspace—it only sends updates outbound. This means:

• OU (or any other attribute) changes made in Google Workspace are not reflected back into Okta's user profile.
• When Okta's next scheduled sync runs, or when you manually trigger a sync, Okta will re-push the OU value from its own profile, overwriting the Google Workspace change.
• This creates the "revert" behavior you are observing.

Solution:

To manage OUs consistently, you must choose a single source of truth and configure your provisioning accordingly:

Option 1: Manage OUs in Okta (Recommended for most organizations)

1. Map the OU attribute in Okta's profile editor. Navigate to Directory → Profile Editor, select the Google Workspace app profile, and ensure the OU or organizational unit attribute is mapped to a field in Okta (for example, user.department or a custom attribute).
2. Update OU values in Okta only. Make all OU changes in Okta's user profiles or import them from your authoritative source (Active Directory, Workday, etc.). Do not make OU changes directly in Google Workspace.
3. Verify provisioning is enabled. In the Google Workspace app, go to Provisioning → Settings and confirm that Provisioning to App is enabled and that the OU attribute is included in the provisioning payload.
4. Trigger a sync. Okta will push the OU value to Google Workspace. Scheduled syncs occur automatically (typically every few hours), or you can manually force a sync by navigating to Provisioning → Push Groups or Provisioning → Settings and selecting Force Sync (if available for your app).

Option 2: Manage OUs in Google Workspace (Requires bidirectional sync setup)

If you need to manage OUs primarily in Google Workspace and have Okta reflect those changes, you must set up profile import or directory sync from Google Workspace back into Okta. This is not the default behavior and requires additional configuration:

1. Contact Okta Support to verify whether your Google Workspace integration supports inbound attribute sync (profile import). Not all app integrations support bidirectional sync.
2. If supported, enable profile import in the Google Workspace app settings. This allows Okta to periodically read user attributes from Google Workspace and update Okta's user profiles.
3. Set profile source priority. If you have multiple sources (AD, Workday, Google Workspace), navigate to Directory → Profile Sources and set the priority so that Google Workspace updates take precedence for the OU attribute.
4. Understand the sync schedule. Profile imports typically run on a schedule (often every few hours). Changes made in Google Workspace will be reflected in Okta after the next import cycle, but this is not real-time.

Sync Frequency and Manual Triggers:

• Scheduled syncs: By default, Okta runs provisioning syncs automatically on a schedule (typically every 30 minutes to a few hours, depending on your org's configuration). The exact frequency is set in your app's provisioning settings.
• Manual sync: To manually trigger a provisioning sync, navigate to the Google Workspace app, go to Provisioning → Settings, and look for a Force Sync or Sync Now button. This immediately pushes pending changes to Google Workspace.
• API-based sync: Okta does not currently support triggering syncs via API for most applications. Manual or scheduled syncs are the primary options.

Best Practice:

Designate Okta as your authoritative source for OU management. This ensures consistency, prevents conflicts, and simplifies troubleshooting. If you need OU data to originate from Google Workspace, work with Okta Support to configure inbound profile import and set appropriate source priorities.

We hope this resolves the issue. If you need account-specific verification of your provisioning configuration or bidirectional sync capabilities, please contact Okta Support.

NOTE: If you are leveraging a custom SCIM implementation instead of the OIN catalog Google Workspace app implementation, please reach out to devforum.okta.com for clarification, as custom SCIM apps are their purview.  

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added