Okta Certified Administrator · Part I

Identity and Access Management

36% of the exam — the single largest domain.

Identity & Access Management

Module 1: Active Directory Integration

6 sub-topics · this deck covers sub-topic 6 of 6 — the last one in this module

← Back to Sub 5: User Activation Options ↑ Module 1 Overview

The Exam Bullet

"Demonstrate an understanding of the difference between AD groups and Okta groups"

AD and Okta both use the word "group." They don't behave identically once data crosses from one system into the other — this topic is about the real structural gap between them.

The Mechanism — Import Scope

The AD agent detects every group inside a selected domain or Organizational Unit. If multiple agents are registered across multiple domains and the root OU is selected for each one, every group across all of those domains gets imported.

The Gotcha — The Core Difference: Nesting

This is the centerpiece fact for this topic: Active Directory supports nested groups. Okta does not.

On import, Okta flattens the hierarchy — it adds each user directly into every ancestor group instead of preserving the parent/child group structure.

A deep AD group tree becomes a set of flat, independent memberships once it lands in Okta.

The Gotcha — Payload Size Limits

Okta caps the total bytes an agent can send in a single request. Large group imports are automatically split across multiple requests to stay under that limit.

But one single, oversized group can still trigger an HTTP 413 (Payload Too Large) error on its own. The fix is to restructure that group's direct membership into nested sub-groups on the AD side before import — ironic, given Okta itself won't preserve that nesting, but it shrinks the payload enough to import successfully.

The Exam Angle

Watch for scenario questions built around these exact traps:

→ "A deeply nested AD group structure doesn't show the same hierarchy once it's in Okta." = expected — Okta flattens nested groups on import.

→ "One specific large group consistently fails to import with an error." = HTTP 413, payload too large — fix by sub-grouping it in AD first.

One Line To Remember

AD supports nested groups; Okta doesn't — Okta flattens the hierarchy on import, adding users directly to every ancestor group. Import scope follows selected domains/OUs (root OU + multiple agents = all groups). One oversized group can still trigger an HTTP 413 even with automatic request-splitting — fix by nesting sub-groups in AD before import.

Sources: help.okta.com — ad-agent-import-groups.htm · ad-agent-manage-users-groups.htm

✓ Module 1: Active Directory Integration — complete (6 of 6 sub-topics)