Okta Group Membership Cannot Be Modified Because the Group Is Managed Automatically By Okta
Last Updated:
Overview
When an Okta group displays a message indicating that membership cannot be modified, it means an external application or directory integration has imported the group. Administrators must manage group membership via an external source or remove the group using the Okta API. The Okta Admin Console displays a warning message indicating that the group membership requires automatic management by Okta.
The group's membership cannot be modified because the group is managed automatically by Okta
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Admin Console
- User Lifecycle Management
Cause
An external application or directory integration source that supports the Import Group or Refresh App Groups feature imported the group. The group membership/details require management via the external group source.
Solution
How is the source application of an imported group verified?
Verify the source application of the imported group by searching the Okta System Log with the application user management event type and the target display name.
eventType eq "app.user_management" and target.displayName eq "{SPECIFY_APP_GROUP_NAME_HERE}"
App-imported groups must be removed via the Okta API.
The Okta Admin Console restricts manual removal of an app-imported group or group membership. Delete a specific app-imported group or remove all previously imported app groups in bulk from a specific application by reviewing the following resources.
