Okta Group Push By Rule Capacity Limits
Last Updated:
Overview
Okta Group Push uses existing Okta groups and their memberships to provision users to third-party applications. When using the Group Push by rule method, a single rule cannot match more than 100 groups, or the request fails. Administrators must use the Group Push by name method to push an unlimited number of groups or create multiple rules to accommodate larger group sets.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Group Push by rule
Solution
What are the limits for pushing groups to applications in Okta?
Okta pushes groups to applications using one of two methods. Review the following methods and their respective limits for pushing groups to applications.
- By name: An Okta application administrator selects groups from Okta to create and update in the target application. The number of groups added when using the By name method is unlimited.
- By rule: An Okta application administrator uses a string required in the group name, or uses both the group name and description to push multiple groups simultaneously. The By rule method is not available for Active Directory (AD) integrations. When adding pushed groups by rule, no more than 100 groups can match the filter. If more than 100 groups match, the request fails.
Review the following image for an example of the pushed groups interface.
Administrators cannot specify a regular expression (regex) to add all Okta groups to a group push.
NOTE: Administrators must avoid using the same Okta group for assignments and group push. To maintain consistent group membership between Okta and the downstream application, administrators must create and configure a separate group to push groups to the target application.
