29% of the exam — the second-largest domain.
6 sub-topics · this deck covers sub-topic 1 of 6
↑ Module 1 OverviewWhen an HR system like Workday becomes the source of truth for user data, group membership shouldn't need a human to keep updating it by hand. This sub-topic is about the automation that makes that possible: group rules.
Group rules automatically populate groups based on user attributes. They simplify group administration and are used to manage application access, application roles, and security policies — without an admin manually adding or removing anyone.
Rules work both directions: when a user's attributes match the rule's conditions, they're added to the group; when their attributes stop matching, they're automatically removed. No manual cleanup required.
This is the textbook use case for HR-sourced group rules: use the cost center attribute from Workday to determine AD group memberships.
As an employee's cost center changes in Workday (a transfer, a reorg), their AD group membership updates automatically through Okta — no ticket, no manual re-assignment.
Both are easy exam traps: assuming any admin role can edit rules, or assuming rule count is unlimited.
Watch for scenario questions built around this trap:
→ "A help desk admin needs to edit a group rule and can't." = expected — only Super/Org Admins can edit rules.
Sources: help.okta.com — usgp-user-profiles-main.htm · usgp-about-group-rules.htm
Next: Sub 2 →