Hey folks, hitting a wall here and need some collective wisdom. Our engineering org structure is like a petri dish on caffeine—teams form, merge, splinter, and dissolve seemingly every quarter. We're using Okta for SSO and app provisioning, which is great, but the **manual overhead of keeping group memberships accurate is becoming a full-time job** for someone.
We have groups for everything: access to specific GitHub orgs, AWS account roles, internal tool entitlements, Slack channels (via SCIM), you name it. The problem is our source of truth—HRIS for department, managers, location—feels disconnected from these dynamic project-based groupings. When someone switches teams, we're playing whack-a-mole across a dozen groups.
I'm curious about your battle-tested setups. What's working for you in a high-change environment?
* Are you leaning heavily on **Okta Workflows** to automate adds/removes based on attributes (like `department` or `costCenter`)? How do you handle the "fuzzy" mappings, like a frontend engineer needing access to both the "Product-Web" and "Platform-UI" groups?
* Have you integrated a **third-party tool** (like Rippling, Workato, or even custom scripts hitting the Okta API) that sits between your HRIS and Okta to manage more complex logic?
* What about **Dynamic Groups** vs. **Static Groups**? We use Dynamic for clear-cut attributes (e.g., `employeeType eq "Contractor"`), but many of our needs are based on transient project assignments not stored in Okta user profiles.
* How do you structure delegation? Do you empower team leads to manage certain group memberships themselves via Okta Groups Admin, or is that a compliance nightmare waiting to happen?
The dream is something like: a change in our project management tool (e.g., Jira portfolio) triggers a workflow that updates a custom attribute in Okta, which then feeds into dynamic group rules. But the plumbing feels... intricate.
Would love to hear your real-world stories, especially the "gotchas" and scaling pains. What broke when you hit 500 engineers? 1000? How much custom logic lives outside Okta?