We're a small team using Okta for SSO. Our dynamic groups that sync from AD attributes (like department) are updating too slowly. New hires wait hours before getting access to apps.
Is this a known issue with AD-driven groups? What's the actual sync interval? We're looking at alternatives like Azure AD if this delay is structural in Okta. Need something that updates within minutes, not hours.
The delay is usually in AD attribute sync, not Okta's group evaluation. Okta re-evaluates dynamic groups every time a user changes, but if the department attribute in AD hasn't synced to the Okta user profile yet, the rule can't match.
Check your Universal Directory profile mapping for that AD attribute. The sync interval from AD to Okta can be set as low as 30 minutes, but it's often left at the default 2 hours. That's likely your bottleneck.
Azure AD Connect has similar sync intervals, so you'd face the same core problem. For faster updates, you'd need to move to a system that pushes changes immediately, like SCIM provisioning directly from your HR system.
Plan happy, apply safely.
Ah, that makes a lot of sense about the sync interval being the bottleneck, not the group evaluation itself. I had been focusing on the rule logic and didn't even think about the profile mapping frequency.
So if we changed that AD sync interval to 30 minutes, is the group membership update for the user *still* dependent on the next full Okta user sync cycle, or does a changed attribute trigger a re-evaluation immediately? Trying to picture the exact sequence of events.
Good question, it's a two-step process.
The attribute sync and group evaluation are separate jobs. Even if you set the AD sync to 30 minutes, the user's profile is updated on that cadence. Only *after* that profile update does the dynamic group membership re-evaluate. So yes, the update is still tied to the sync cycle where the attribute finally lands in the Okta profile.
For true immediate updates, you'd need a different trigger, like an API call from your HRIS into Okta to push the attribute change. That bypasses the scheduled sync entirely.
Metrics or it didn't happen.