When I remove user from the group in Okta it is only deactivated on my end, but not removed from the group.
Please let me share the full scenario I tested. I understand that removal from the last group removes user from the application and this is the reason for deactivation, but I still expect user to be removed from the group.
Create group ycgr7 in Okta
Assign group to application
Push group in Okta.
Create user ycu4 in Okta
Assign ycu4 to yvgr7 in Okta.
As a result I see on my end user ycu4 under group ycgr7
Remove user from the group in Okta:
method=PUT path=/scim/v2/Groups/1349 remoteAddr=54.189.184.116:7100 statusCode=200 requestBody=[{“schemas”:[“urn:ietf:params:scim:schemas:core:2.0:Group”],“id”:“1349”,“displayName”:“ycgr7”,“members”:[{“value”:“16337”,“display”:“ycu4@gmail.com”}]}]
As you can see the last request preserves group membership for the user ycu4
In this scenario is the same group being used for both group_push and to assign the user to the application?
If so this isn’t supported,
Okta doesn’t support using the same group for app assignment and Group Push. If your org doesn’t have separate groups for app assignment and Group Push, see Troubleshoot app assignment and group membership.
With using separate groups make sure to remove a user from the group used for group_push first.
If group rules are used to assign the user from one group to the other you may need to open a support case to get a feature enabled.
By default Okta will not send a group update to SCIM if a user is no longer assigned to the SCIM application. When using group rules to assign a user to both groups the de-provisioning from the SCIM application is likely to happen before the group_push update.
Having support enabling a feature in your Org changes this behavior to send group membership updates regardless if the user is assigned to the SCIM app in Okta.