## TL;DR
Test the expression against one affected user before you edit the rule, because the error rarely says which clause failed. Open the rule, list every profile attribute and function it uses, and check the affected users for a missing or differently typed attribute value, especially department, title or a custom attribute that some users lack. Add null handling or fix the attribute source, preview the rule against the failing users, and only then reactivate it.

```text
expression evaluation failed
```

## Use this when
- Group rules show an evaluation error and membership stops changing.
- Only users from one department or source hit the failure.
- A rule that worked for months broke after an HR attribute change.

## Not for this skill when
- The group is manually assigned. Rule debugging does not apply to it.
- Membership is correct but a downstream app assignment fails. Follow the app assignment error instead.

## Steps
1. Open the failing group rule and copy its full expression into the ticket, marking each attribute, function and comparison it contains. Verify: every attribute named in the expression is listed.
2. Pick three users who triggered the error and open their Okta profiles, checking each marked attribute for a value, its type and whether it comes from an HR source or manual entry. Verify: the missing or mistyped attribute for the failing users is identified.
3. Check the attribute definition in the profile editor for its external name and type, and compare with the name the expression expects after any recent schema change. Verify: any rename or type change is confirmed or ruled out.
4. Use the rule preview or a test evaluation for one repaired user pattern, adjusting the expression with explicit null handling such as checking the attribute exists before comparing it. Verify: the preview evaluates the sampled users with no error.
5. Fix the source for users whose attribute is genuinely wrong, usually the HR mapping or a profile mapping, rather than broadening the expression to swallow bad data. Verify: the sampled users profiles show corrected values after the next sync.
6. Reactivate the rule, watch the next evaluation run in the system log, and confirm membership changes land for the previously failing users. Verify: the rule run completes and a sampled user gains or loses membership as expected.
7. Note the brittle attribute in the review evidence and add it to the pre-cycle checks for groups that feed access decisions. Verify: the attribute is on the checklist used before the next campaign.

## Why it happens
Okta group rule expressions assume the attributes they read are present and typed as expected. Real directories break that assumption constantly: a feed renames a field, a user type lacks a custom attribute, or a value arrives as a list where the expression expects a single string. Evaluation then fails for a slice of users while the rule looks fine in the editor. Sampling real failing profiles against the expression, clause by clause, finds the exact assumption that broke, and the durable fix is usually at the attribute source.

## Variants and edge cases

### Okta group rule not evaluating for some users
The partial phrasing. Partial failure points at user data, so sample failing profiles before touching the expression.

### group rule broke after HR attribute rename
The change phrasing. Update both the mapping and any expression that reads the old external name.

### expression evaluation failed on custom attribute
The custom attribute phrasing. Custom attributes vary by user type, so check the failing users type first.

Edge cases to check before closing the review cycle:
- Functions that join or split strings fail hard on null. Guard every string function with an existence check.
- Deactivating a rule freezes membership but keeps the group usable for a campaign snapshot. Note the freeze date in evidence.
- Rule preview samples may not include the failing user type. Add a failing user to the preview set deliberately.

Compatibility: Okta group rules and profile attributes, Okta Expression Language, Okta system log for rule evaluation events.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DCShF5R6r6t1kmPoMov8Lw