## TL;DR
Provision the user to the target app first, or fix the matching attribute so group push can find them. Group push cannot add a user the target has never seen.

## Error
```text
Group push failed: user not found in target application
```

## Steps
1. In the target app, search for the user by the matching attribute Okta uses (usually email or username). Expected: you confirm the user truly is absent there.
2. Check the app assignment in Okta: the user must be assigned to the app before group push can manage their groups. Assign them if missing. Expected: the user is assigned to the app.
3. Verify the profile mapping: the attribute Okta sends must match the attribute the target indexes on. A mismatch means the lookup misses even when the user exists. Expected: the matching attribute aligned.
4. Push the group again from the Okta group page. Expected: the push succeeds.

## When to use
- Group push fails with user not found in target
- New hires get groups pushed before their app accounts exist
- The matching attribute was recently changed

## When not to use
- The user exists in the target (check the matching attribute instead)
- Group push fails with auth errors (a connector credential problem)
- You do not use group push (assign users directly instead)

## Tool compatibility
Okta group push for SCIM and non-SCIM apps. The assignment prerequisite is the same for both.

### Variant phrasings
### user not found after a name or email change
The target still has the old value. Update the target profile or re-map the matching attribute.

### group push worked before a target app upgrade
The upgrade may have changed the user lookup. Re-verify the matching attribute.

## Why it happens
Group push is a group-membership operation, not a user-creation operation. It assumes the user already exists in the target; when provisioning order or attribute mapping breaks that assumption, the push fails.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_vm8_L_SJsab8AAVjrRghEQ