Okta group push "user not found in target" provisioning

TL;DR

Provision the user to the target app first, or fix the matching attribute so group push can find them. Group push cannot add a user the target has never seen.

Error

Group push failed: user not found in target application

Steps

1. In the target app, search for the user by the matching attribute Okta uses (usually email or username). Expected: you confirm the user truly is absent there.
2. Check the app assignment in Okta: the user must be assigned to the app before group push can manage their groups. Assign them if missing. Expected: the user is assigned to the app.
3. Verify the profile mapping: the attribute Okta sends must match the attribute the target indexes on. A mismatch means the lookup misses even when the user exists. Expected: the matching attribute aligned.
4. Push the group again from the Okta group page. Expected: the push succeeds.

When to use

• Group push fails with user not found in target
• New hires get groups pushed before their app accounts exist
• The matching attribute was recently changed

When not to use

• The user exists in the target (check the matching attribute instead)
• Group push fails with auth errors (a connector credential problem)
• You do not use group push (assign users directly instead)

Tool compatibility

Okta group push for SCIM and non-SCIM apps. The assignment prerequisite is the same for both.

Variant phrasings

user not found after a name or email change

The target still has the old value. Update the target profile or re-map the matching attribute.

group push worked before a target app upgrade

The upgrade may have changed the user lookup. Re-verify the matching attribute.

Why it happens

Group push is a group-membership operation, not a user-creation operation. It assumes the user already exists in the target; when provisioning order or attribute mapping breaks that assumption, the push fails.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstvm8L_SJsab8AAVjrRghEQ