Hey folks! I've been wrestling with a classic Okta admin headache and wanted to see how others have solved it.
We want our helpdesk team to be able to handle daily group membership requests (like adding/removing people from "Salesforce-Users" or "New-York-Office") without touching the broader admin console or any sensitive configurations. Full Super Admin is way too much power, and creating custom admin roles feels... risky and clunky.
From what I've tested and gathered, the path seems to be a combination of:
* **A Custom Administrator Role:** You can create one with *only* the "Group Membership" permission (under the "Groups" category). This is the foundation.
* **Very Tight Scope:** The real trick is scoping that role. You can scope it to specific groups, which is perfect. So you create a role like "Group Membership Manager," assign it to your helpdesk team members, but then scope it to only the non-sensitive, IT-support groups you want them to manage.
* **Leveraging the "Groups" Admin Page:** Users with this role get a simplified view in the admin console—basically just the **Directory > Groups** section, and only for their scoped groups. They can't see Apps, Policies, or anything else.
Has anyone set this up in production? My main questions are:
* Any pitfalls with the custom role approach? Does it work smoothly for your helpdesk?
* How do you handle group creation? We're thinking of keeping that as a separate, higher-level task for sysadmins, while helpdesk just manages memberships of pre-defined groups.
* Is there a cleaner way using Group Rules or the API that we're overlooking?
I'm a big fan of side-by-side comparisons, so if there's an alternative workflow using Okta Workflows or something, I'd love to hear about that too!
✌️