# OKTA 100 groups truncation **URL:** \ **Category:** OAuth/OIDC\ **Tags:** claims\ **Created:** [April 23, 2026, 5:34pm UTC](https://devforum.okta.com/t/okta-100-groups-truncation/35236 "2026-04-23T17:34:03Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![simhasuraj7](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/simhasuraj7/32/6521_2.png) [@simhasuraj7](https://devforum.okta.com/u/simhasuraj7)\ **Post date:** [April 23, 2026, 5:34pm UTC](https://devforum.okta.com/t/okta-100-groups-truncation/35236/1 "2026-04-23T17:34:03Z")
Hi, I have seen some articles telling okta groups claim in id\_token will be truncated or will be nil when the groups are more than 100, but I have set up a user and assigned more than 300 groups and when I try to see the token preview under Security → API → Default auth server → claims, I see all 300 groups and nothing being truncated. I see the truncation happening only when I filter the groups claim using an expression like Groups.startsWith(“OKTA”, “TEST”, 100) which is obvious. Am I missing something here? I want to replicate the scenario of groups being truncated or being nil when it is more than 100 or 200. Any suggestions? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [April 23, 2026, 5:36pm UTC](https://devforum.okta.com/t/okta-100-groups-truncation/35236/2 "2026-04-23T17:36:14Z")
Only the Groups functions (`Groups.startsWith`, `Groups.endsWith`, and `Groups.contains`) require passing a `limit` argument which is a maximum of 100 (mentioned [here](https://support.okta.com/help/s/article/limitations-of-group-functions-dynamic-allowlists?language=en_US)). Other group functions (such as [user.getGroups)](https://developer.okta.com/docs/reference/okta-expression-language/#get-groups-for-users) do not have this limitation and are able to return _all_ matching groups in the resulting claim. ---
**Author:** ![simhasuraj7](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/simhasuraj7/32/6521_2.png) [@simhasuraj7](https://devforum.okta.com/u/simhasuraj7)\ **Post date:** [April 24, 2026, 4:04am UTC](https://devforum.okta.com/t/okta-100-groups-truncation/35236/3 "2026-04-24T04:04:13Z")
thank you for the response! but when I do `Groups.startsWith(“OKTA”, “TEST”, 200)`, I see 200 groups in the token preview. Also just wanted to confirm if I use a regex like `.*` will it return all the groups in the id\_token and has no limit? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [April 24, 2026, 5:23pm UTC](https://devforum.okta.com/t/okta-100-groups-truncation/35236/4 "2026-04-24T17:23:38Z")
Hmm, passing a `200` limit shouldn’t work as far as I understand it! If you actually request a token, do you see the groups claim showing up, or does it only work in the Token Preview tool? If you are using Authorization Code flow, you shouldn’t see any other limits on the number of groups returned in a groups claim, but let me know if you see otherwise ---
**Author:** ![simhasuraj7](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/simhasuraj7/32/6521_2.png) [@simhasuraj7](https://devforum.okta.com/u/simhasuraj7)\ **Post date:** [April 24, 2026, 5:51pm UTC](https://devforum.okta.com/t/okta-100-groups-truncation/35236/5 "2026-04-24T17:51:21Z")
yes, I see a big fat id token which when decoded, I get all the groups even if it is more than 200. and yes I am using Authorization code flow. With any other grant type will the groups be truncated? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [April 24, 2026, 6:04pm UTC](https://devforum.okta.com/t/okta-100-groups-truncation/35236/6 "2026-04-24T18:04:54Z")
You should see a failure if a groups claim is evaluating to more than 100 users if using a different grant type (thats what I saw at least when testing this with implicit grant type) ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [May 1, 2026, 9:24am UTC](https://devforum.okta.com/t/okta-100-groups-truncation/35236/7 "2026-05-01T09:24:04Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.