Okta Certified Workflows - Specialty · Part II

Create Groups

26% of Part II — group lifecycle from connection to membership.

Create Groups

Task 4: Add Users to a Group

4 tasks · this deck covers task 4 of 4

The Task

"Add users to a group"

Once a group exists (Task 2) with a name (Task 3), membership is populated with the Add User to Group action card: "Add a new Okta user to a group."

Inputs and Outputs

Input — Group: ID (Text, required)
Input — User: ID (Text, required)
Output — Status (Number): HTTP status code

Both IDs are required with no optional fields — this card expects you to have already resolved the Group ID (from Task 2's Create Group output) and the User ID upstream in the flow.

Reading the Status Output

"A 204 status code indicates that the user was added."
"A 403 error indicates that the HTTP request wasn't processed because the necessary permissions were missing."

The card doesn't throw a flow error on a non-2xx result by default — it returns the numeric status. Whether the flow treats a 403 as a hard stop is up to the branching logic built around the card.

The Mechanism — Branching Around It

Conditional add-logic (e.g., "only add this user if they belong to a certain department") is built with Okta Workflows' branching functions:

If/Else — single condition, standard two-path branch
If/ElseIf — multiple conditions, similar to Switch/Case
Assign If — assigns one of two values based on a true/false result
Continue If — halts flow execution if a condition isn't met (distinct from Return Error If, which stops with an explicit error)

The Connection — Testing This Flow

↳ Full deck: Troubleshooting Flows, Module 1

Once your Create Groups flow runs end to end — connection, group creation, naming, membership — the discipline for verifying it (running with test data, reading execution history, catching a 403 before it ships) lives in the Troubleshooting Flows section, not repeated here.

The Angle — What Trips People Up

Watch for this in your own sandbox run:

→ Assuming a non-204 Status means the flow itself errored — it doesn't unless you add branching logic (Continue If / Return Error If) that acts on that status code.

→ Reaching for If/Else when you actually have three or more membership conditions — that's If/ElseIf territory.

One Line To Remember

Add User to Group takes a required Group ID and User ID and returns an HTTP status Number (204 = added, 403 = missing permissions) — it does not auto-fail the flow on a bad status. Wrap it in If/Else, If/ElseIf, Assign If, or Continue If to make conditional-add logic explicit.

✓ Create Groups — 4 of 4 courses complete

Sources: help.okta.com — Add User to Group action card (type=wf&id=ext-okta-method-addnewusertogroup); Branching functions (functions.htm#branching)