Okta Push Group Fails With Update Group Membership Error
Last Updated:
Overview
Okta generates a push group error when the group attempts to push a user that was deleted in the downstream application. Unassigning the deleted user from the application in Okta resolves this issue. The following error appears during the group push:
Changes to the Group push mapping for the group [Group Name] could not take effect due to error: Error while updating user group membership for group [Group Name]: One or more errors occurred during update group membership.
Using the Transaction ID for the failed push group, the additional error is seen:
failure: Not found: Resource not found: [user ID] (User)
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Push Groups
- Enhanced Push Groups
Cause
The error occurs because the push group attempts to push a user that was deleted in the downstream application. Okta fails to find the user in the target application, which breaks the push group synchronization.
Solution
How is the update group membership error resolved?
Identify the deleted user using the application Application Programming Interface (API), unassign the user from the application in the Okta Admin Console, and reactivate the push group flow.
- Use the application Application Programming Interface (API) to find the username associated with the ID in the secondary log.
- Compare the times for the push group failures and recent deletions in the target application if the API returns no user.
- Navigate to the Okta Admin Console and go to Applications > Applications.
- Select the application experiencing the push group error.
- Go to the Assignments tab and unassign the user.
- Reassign the user to the application to initiate the provisioning flow if the user requires access to the target application.
- Go to the Push Groups tab and select the Activate flow option.
