Okta_Group

An Okta user group

Overview

Groups in Okta are collections of users that can be used to manage access to applications and resources. Groups can be created manually or synchronized from external directories such as Active Directory. The built-in Everyone group always contains all users in the Okta organization. Only users can be members of groups and groups cannot be nested.

In OktaHound, groups are represented as Okta_Group nodes.

Edges

The tables below list edges defined by the OktaHound extension only. Additional edges to or from this node may be created by other extensions.

Inbound Edges

Edge Type	Source Node Types	Traversable
Okta_AddMember	Okta_User, Okta_Group, Okta_Application	✅
Okta_Contains	Okta_Organization	✅
Okta_GroupAdmin	Okta_User, Okta_Group, Okta_Application	✅
Okta_GroupMembershipAdmin	Okta_User, Okta_Group, Okta_Application	✅
Okta_GroupPull	Okta_Application	✅
Okta_IdpGroupAssignment	Okta_IdentityProvider	❌
Okta_MemberOf	Okta_User	✅
Okta_MembershipSync	Okta_Group, Group, AZGroup	✅
Okta_OrgAdmin	Okta_User, Okta_Group, Okta_Application	✅
Okta_ResourceSetContains	Okta_ResourceSet	✅
Okta_ScopedTo	Okta_RoleAssignment	❌

Outbound Edges

Edge Type	Destination Node Types	Traversable
Okta_AddMember	Okta_Group	✅
Okta_AppAdmin	Okta_Application, Okta_ApiServiceIntegration	✅
Okta_AppAssignment	Okta_Application	❌
Okta_GroupAdmin	Okta_User, Okta_Group	✅
Okta_GroupMembershipAdmin	Okta_Group	✅
Okta_GroupPush	Okta_Application	❌
Okta_HasRole	Okta_Role, Okta_CustomRole	❌
Okta_HasRoleAssignment	Okta_RoleAssignment	❌
Okta_HelpDeskAdmin	Okta_User	✅
Okta_ManageApp	Okta_Application	✅
Okta_MembershipSync	Okta_Group, Group, AZGroup	✅
Okta_MobileAdmin	Okta_Device	✅
Okta_OrgAdmin	Okta_User, Okta_Group, Okta_Device	✅
Okta_ReadClientSecret	Okta_ClientSecret	✅
Okta_ResetFactors	Okta_User	✅
Okta_ResetPassword	Okta_User	✅
Okta_SuperAdmin	Okta_Organization	✅

Properties

Standard Okta group properties:

Name	Source	Type	Description
id	group.id	string	Unique group identifier.
name	group.profile.name	string	Group name in Okta (or synchronized source).
displayName	group.profile.name	string	Display label used in BloodHound.
description	group.profile.description	string	Group description text.
oktaDomain	Collector context (non-API)	string	Okta organization domain where the group exists.
hasRoleAssignments	Calculated	bool	Indicates whether the group is assigned any administrative roles.
oktaGroupType	group.type	string	Group type (for example OKTA_GROUP, APP_GROUP, BUILT_IN).
objectClass	group.objectClass[0]	string	Source object class (for example AD security principal).
created	group.created	datetime	Group creation timestamp.
lastUpdated	group.lastUpdated	datetime	Last update timestamp.
lastMembershipUpdated	group.lastMembershipUpdated	datetime	Last membership change timestamp.

Additional properties of groups synchronized from Active Directory:

Name	Source	Type	Description
objectSid	group.profile.objectSid	string	Security Identifier (SID) for the AD group.
distinguishedName	group.profile.dn	string	Active Directory distinguished name.
samAccountName	group.profile.samAccountName	string	Security Account Manager (SAM) account name.
domainQualifiedName	group.profile.windowsDomainQualifiedName	string	Domain-qualified name of the AD group.
groupScope	group.profile.groupScope	string	AD group scope (for example global, domainLocal, universal).
groupType	group.profile.groupType	string	AD group type, i.e., security or distribution.
objectGuid	Base64ToGuid(group.profile.externalId)	string	AD object GUID.

Sample Property Values

Example of a group created directly in Okta:

id: 00gxg12p4kFOkyXLb697
name: Engineering
displayName: Engineering
description: Engineering department group
oktaDomain: contoso.okta.com
hasRoleAssignments: false
oktaGroupType: OKTA_GROUP
objectClass: okta:user_group
created: 2025-11-14T08:00:25+00:00
lastUpdated: 2025-11-14T08:00:25+00:00
lastMembershipUpdated: 2025-11-14T08:00:25+00:00

Example of a group synchronized from Active Directory:

id: 00gxga7s3yDJ71OzW697
name: Sales
displayName: Sales
description: Sales department group
oktaDomain: contoso.okta.com
hasRoleAssignments: false
oktaGroupType: APP_GROUP
objectClass: okta:windows_security_principal
objectSid: S-1-5-21-71365889-924527929-2677699343-2536
distinguishedName: CN=Sales,CN=Groups,DC=contoso,DC=local
samAccountName: Sales
domainQualifiedName: CONTOSO\Sales
groupScope: Global
groupType: Security
objectGuid: 4ab65ef0-ab82-4017-b5ee-1c20facd4d6a
created: 2025-11-14T12:58:13+00:00
lastUpdated: 2025-11-14T13:05:44+00:00
lastMembershipUpdated: 2025-11-14T12:58:13+00:00

Synchronization with External Directories

Similarly to users, groups can also be synchronized from external directories. The Okta API exposes the original Active Directory attributes, which are then collected by OktaHound:

Nested (transitive) group memberships in Active Directory are always flattened (resolved) when synchronized to Okta, as illustrated below: