Skip to content

Okta Workflows — Connector-Specific Quirks (§5)

Ten quirks split across the Okta connector (5.1–5.4) and the Azure AD / Microsoft Entra ID connector (5.5–5.10).

Okta connector

Quirk 5.1 — Search Groups uses exact eq only (except Custom Search Criteria)

"The card performs an eq (equal) comparison against the provided input value, except for the Custom Search Criteria input." For starts-with/contains you must use the Custom Search Criteria field (sw, ew, etc.).

  • Source: okta/actions/searchgroups.htm

Quirk 5.2 — Group Type semantics for APP_GROUP filtering

On the Okta Search Groups card: OKTA_GROUP = "managed either directly in Okta through static assignments, or indirectly through group rules"; APP_GROUP = "imported and must be managed within the app (such as Active Directory or LDAP) that imported the group"; BUILT_IN = "Okta manages the group profile and memberships and can't be modified." When syncing Entra-imported groups on the Okta side, filter Type = APP_GROUP — but because the card uses simple eq, unexpected filtering usually means you need Custom Search Criteria or the Custom API Action card. No confirmed public bug report of APP_GROUP filtering misbehaving was found — treat any such claim as UNCONFIRMED.

  • Source: okta/actions/searchgroups.htm

"The search function executes a keyword search rather than an exact string match… the API searches for the provided keywords across the Name, Expression Conditions, and Group Assignments fields… even the First Matching Record option returns an unexpected group rule." Workaround: return the list (First 200 / Stream) then Filter or Find for an exact name match.

  • Source: support.okta.com okta-workflows-search-group-rule-card-returns-unexpected-multiple-results (updated May 6, 2026)

Quirk 5.4 — Okta connector concurrency/rate limits differ from raw API

Built-in Okta connector: 30 concurrent Workflows → Okta requests, 15 concurrent GET/READ per-user requests, 6,000 requests/minute total. These requests do NOT appear in the rate-limits dashboard. DynamicScale/Workforce multipliers raise the concurrent ceiling (5x=50, 10x=80, 25x=120, 50x=150).

  • Source: workflows-system-limits.htm

Azure AD / Microsoft Entra ID connector

Quirk 5.5 — Delegated permissions only, tied to a signed-in account

"The connection uses delegated access and delegated permissions, not app-only access or app-only permissions." The token is tied to an admin/user account — there is NO app-only/service-principal option. Use a dedicated service account.

  • Source: guidanceforazureadconnector.htm

Quirk 5.6 — Reauthorization breaks when config/scopes change

"You can also reauthorize any existing connections if the admin hasn't changed any configuration settings." Changing scopes/config can break simple reauthorization and force a full reconnect.

  • Source: guidanceforazureadconnector.htm

Quirk 5.7 — Three different record caps across Entra cards (correcting a common misconception)

  • Azure AD Search Groups: "The Search Groups action card returns a maximum of 4,000 groups."
  • Azure AD Search Group Members: caps at 900 records — the Result Set option is documented verbatim as "First 900 Matching Records: returns the first 900 records that match the search criteria" (NOT 4,000). Exceed via Stream Matching Records.
  • Azure AD Search Users: "returns a maximum of 4,000 users."

  • Search Group Members input "can't contain the # hash character" (verbatim CAUTION).

  • Sources: azuread/actions/searchgroups.htm; azuread/actions/searchgroupmembers.htm; azuread/actions/searchusers.htm

Quirk 5.8 — Mail-enabled security groups & distribution groups silently fail

"Attempting to manage a Microsoft Entra ID Mail-enabled security group or Distribution group using the Okta workflows Azure Active Directory connector will fail… This can occur with any of the action cards… such as Update Group, Add User to Group, etc." — because the Graph API treats these as read-only. Workaround: manage O365/unified groups instead, or use the on-premises PowerShell template.

  • Source: support.okta.com can-okta-workflows-be-used-to-manage-office-365-mail-enabled-security-groups-and-distribution-groups

Quirk 5.9 — List Contact Folder returns max 2 levels

"The List Contact Folder card returns a maximum of two levels of child folders." Workaround: Custom API Action with nested $expand=childFolders($expand=childFolders).

  • Source: guidanceforazureadconnector.htm

Quirk 5.10 — Search cards that hard-code domain return incomplete results (pattern)

Documented for Google Workspace (cards hard-code the authorizing user's domain instead of customer, returning single-domain results only; fix via Custom API Action with Customer ID). This is a recurring pattern — Workflows "Search" cards often wrap fuzzy or scoped APIs, so post-filtering and Custom API Action are the standard escapes.

  • Source: support.okta.com Workflows-Google-Workspace-Search-Users-or-Search-Groups

Plugin: okta-workflows · View SKILL.md on GitHub