← Course Home
Okta Certified Workflows - Specialty · Part II

Create Groups

26% of Part II — group lifecycle from connection to membership.

Create Groups

Task 1: Create an Okta Connection

4 tasks · this deck covers task 1 of 4

↑ Create Groups Overview

The Task

"Create an Okta connection"

Before any Create Groups flow can run, it needs an authorized connection back into the same Okta org (or a different one) so its cards can call the Okta API. That connection is the Okta connector.

The Mechanism

"Okta provides tools to manage access and authentication based on identity. You can create, update, list, and delete users, add users to groups, assign users to apps, and make custom calls to the Okta API."

"When you add an Okta card to your flow, you need to authorize an account from your Okta org." That authorization step is what creates the connection.

Scale of the Connector

The Okta connector ships dozens of event cards (User Created, Group Created, Import Roadblock, Policy Rule Updated, and more) and dozens of action cards (Create Group, Add New User to Group, Create User, Deactivate User, Custom API Action, and more) — all riding on the one connection you authorize.

Scopes and Token Hygiene

"Grant the required scopes for each of the event and action cards that you want to use in your Okta connector."

Each card you drop into a flow needs its matching OAuth scope granted on the connection. Separately: "When you've deleted a user or a connection to your Okta org, the connector revokes all associated access tokens. You don't have to delete the tokens manually."

The Gotcha — Rate Limits

The docs flag this explicitly: Okta connector cards impact the rate limits for your environment. A flow that fans out many Okta API calls (e.g., adding hundreds of users to a group in a loop) can hit org-wide rate limits — see Workflows system limits before you build high-volume group-membership flows.

The Angle — What Trips People Up

Watch for this in your own sandbox run:

→ Dropping a Create Group or Add User to Group card into a flow before authorizing the connection — the card has nothing to authenticate against until you do.

→ Under-scoping the connection — a missing scope surfaces later as a 403 on the specific action card, not at authorization time.

One Line To Remember

Adding any Okta card to a flow requires authorizing an account from your Okta org first — that authorization is the connection. Grant scopes per card used, and remember deleting a user or connection auto-revokes its tokens. Okta connector cards also count against your org's Workflows rate limits.

Sources: help.okta.com — Okta connector (type=wf&id=ext-okta)