Unable To Remove Active Directory Group Push In Okta

An error occurs when attempting to remove an Active Directory (AD) group push in Okta because an administrator has already deleted the group in AD, resulting in a zombie application group. Resolve this issue by contacting Okta Support to have the zombie application group removed. Administrators experience an inability to unlink or remove a push group from Okta to AD. Okta generates the following error in the dashboard:

Failed on <date>: Unable to update Group Push mapping target App group <group_name>: Error updating AD group: There is no such object on the server.. Verify your configuration settings and if necessary delete this push group and reconfigure.

Okta generates the following error when attempting to delete the group via the API:

The app-managed group <group_id> cannot be deleted because it is used in group push mappings.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Active Directory (AD)
• Group Push

An administrator already deleted the target group in Active Directory, which leaves the application group in a zombie state within Okta. The zombie application group remains tied to the group push mappings, which prevents Okta from successfully unlinking or deleting the group.

If attempting to remove the mapping using the API, the following error is observed:

DELETE /api/v1/apps/'appId'/group-push/mappings/'mappingId'?deleteTargetGroup=true

Status: 400 error
error
{
"errorCode": "E0000001",
"errorSummary": "Api validation failed: com.saasure.framework.validation.util.SimpleErrors: O errors",
"errorLink": "E0000001",
"errorld": "oaeTADMavtOSNetv8dr0X_eyw",
"errorCauses": [
"errorSummary". "Error during group push API operation. please try again later'
}

If attempting to delete the group using the API, the following error is observed:

DELETE /api/v1/groups/'groupId'

Status: 400 error
Error:
{
"errorCode": "E0000001",
"errorSummary": "Api validation failed: group",
"errorLink": "E0000001",
"errorld": "oaewMi8-edQT-es7BSzzzu_5w",
"errorCauses": [
"errorSummary": "The app-managed group 00gi7ymhynCnOJWPO417 cannot be deleted because it is used in group push mappings."
}

How does an administrator remove the zombie application group?

Open a support case with Okta Support and provide the group push details to request the removal of the zombie application group.

1. Gather the Okta group ID, the application ID, and the exact error message.
2. Open a support case with Okta Support.
3. Request that Okta Support remove the zombie application group from the backend.