We have a dual group SCIM setup as per the docs to push users and groups, and realized that Okta is not triggering rules for users being removed from a group having push enabled.
Users have to be assigned to the app for them to be included in the group membership push, therefore they have to be taken out of the access group first, then the automated group membership push job is dispatched, and then they’re supposed to be taken out of the assignment group as per the rule, which doesn’t happen; unless we manually trigger the rule to evaluate by deactivating/activating it, or updating the users profiles manually.
Works as expected if group push is deactivated.