This is an Early AccessEarly Access (EA) features are opt-in features that you can try out in your org by asking Okta Support to enable them. Additionally, the Features page in the Okta Admin Console (Settings > Features) allows Super Admins to enable and disable some EA features themselves. feature. To enable it, please contact Okta Support.

Enable Okta-mastered user OU changes

This applies to Okta-mastered and HR-mastered usersIn Okta literature, we generally refer to "users" as the people who serve as Okta administrators. When we refer to "end users" we are generally referring to the people who the administrators serve. That is, those who use Okta chiclets to access their apps, but have no administrative control. in groupsGroups allow you to organize your end users and the apps they can access. Assigning apps to large sets of end users is made easier with groups. associated with Active Directory (AD) instances. AD should not be the Profile MasterA profile master is an application (usually a directory service such as Active Directory, or human capital management system such as Workday) that acts as a source of truth for user profile attributes. A user can only be mastered by a single application or directory at any one time. For more details, see Using the Okta People Page..

If you have existing Okta-mastered or HR-mastered users who have changed groups, their OUs in AD have not been updated. Enabling this feature will change their OUAn acronym of Organizational Unit. Organizational units are Active Directory containers into which you can place users, groups, computers, and other organizational units. It is the smallest scope or unit to which you can assign Group Policy settings or delegate administrative authority. in AD.

Note: Because the provisioning flow is from Okta to AD, if the OU is changed in AD, the change is not reflected in Okta. The next time Okta pushes updates to AD, the AD changes will be overwritten by the Okta-master information.

The Assignments tab in the AD instance displays all users and groups associated with that AD instance.