Overview
Groups in Okta are collections of users that can be used to manage access to applications and resources. Groups can be created manually or synchronized from external directories such as Active Directory.
The built-in Everyone group always contains all users in the Okta organization. Only users can be members of groups and groups cannot be nested.
In OktaHound, groups are represented as Okta_Group nodes.
Edges
The tables below list edges defined by the OktaHound extension only. Additional edges to or from this node may be created by other extensions.
Inbound Edges
| Edge Type | Source Node Types | Traversable |
|---|
| Okta_AddMember | Okta_User, Okta_Group, Okta_Application | ✅ |
| Okta_Contains | Okta_Organization | ✅ |
| Okta_GroupAdmin | Okta_User, Okta_Group, Okta_Application | ✅ |
| Okta_GroupMembershipAdmin | Okta_User, Okta_Group, Okta_Application | ✅ |
| Okta_GroupPull | Okta_Application | ✅ |
| Okta_IdpGroupAssignment | Okta_IdentityProvider | ❌ |
| Okta_MemberOf | Okta_User | ✅ |
| Okta_MembershipSync | Okta_Group, Group, AZGroup | ✅ |
| Okta_OrgAdmin | Okta_User, Okta_Group, Okta_Application | ✅ |
| Okta_ResourceSetContains | Okta_ResourceSet | ✅ |
| Okta_ScopedTo | Okta_RoleAssignment | ❌ |
Outbound Edges
Properties
Standard Okta group properties:
| Name | Source | Type | Description |
|---|
id | group.id | string | Unique group identifier. |
name | group.profile.name | string | Group name in Okta (or synchronized source). |
displayName | group.profile.name | string | Display label used in BloodHound. |
description | group.profile.description | string | Group description text. |
oktaDomain | Collector context (non-API) | string | Okta organization domain where the group exists. |
hasRoleAssignments | Calculated | bool | Indicates whether the group is assigned any administrative roles. |
oktaGroupType | group.type | string | Group type (for example OKTA_GROUP, APP_GROUP, BUILT_IN). |
objectClass | group.objectClass[0] | string | Source object class (for example AD security principal). |
created | group.created | datetime | Group creation timestamp. |
lastUpdated | group.lastUpdated | datetime | Last update timestamp. |
lastMembershipUpdated | group.lastMembershipUpdated | datetime | Last membership change timestamp. |
| Name | Source | Type | Description |
|---|
objectSid | group.profile.objectSid | string | Security Identifier (SID) for the AD group. |
distinguishedName | group.profile.dn | string | Active Directory distinguished name. |
samAccountName | group.profile.samAccountName | string | Security Account Manager (SAM) account name. |
domainQualifiedName | group.profile.windowsDomainQualifiedName | string | Domain-qualified name of the AD group. |
groupScope | group.profile.groupScope | string | AD group scope (for example global, domainLocal, universal). |
groupType | group.profile.groupType | string | AD group type, i.e., security or distribution. |
objectGuid | Base64ToGuid(group.profile.externalId) | string | AD object GUID. |
Sample Property Values
Example of a group created directly in Okta:
id: 00gxg12p4kFOkyXLb697
name: Engineering
displayName: Engineering
description: Engineering department group
oktaDomain: contoso.okta.com
hasRoleAssignments: false
oktaGroupType: OKTA_GROUP
objectClass: okta:user_group
created: 2025-11-14T08:00:25+00:00
lastUpdated: 2025-11-14T08:00:25+00:00
lastMembershipUpdated: 2025-11-14T08:00:25+00:00
id: 00gxga7s3yDJ71OzW697
name: Sales
displayName: Sales
description: Sales department group
oktaDomain: contoso.okta.com
hasRoleAssignments: false
oktaGroupType: APP_GROUP
objectClass: okta:windows_security_principal
objectSid: S-1-5-21-71365889-924527929-2677699343-2536
distinguishedName: CN=Sales,CN=Groups,DC=contoso,DC=local
samAccountName: Sales
domainQualifiedName: CONTOSO\Sales
groupScope: Global
groupType: Security
objectGuid: 4ab65ef0-ab82-4017-b5ee-1c20facd4d6a
created: 2025-11-14T12:58:13+00:00
lastUpdated: 2025-11-14T13:05:44+00:00
lastMembershipUpdated: 2025-11-14T12:58:13+00:00
Synchronization with External Directories
Similarly to users, groups can also be synchronized from external directories. The Okta API exposes the original Active Directory attributes, which are then collected by OktaHound:
Nested (transitive) group memberships in Active Directory are always flattened (resolved) when synchronized to Okta, as illustrated below:
