Are AD groups created in Okta, requiring all changes to be done in Okta and pulled into AD?

Active Directory (AD) groups created in Okta do not require all changes to occur in Okta and be pulled into AD. Typically, the integration between Okta and AD allows for bi-directional synchronization of groups, meaning that changes made in AD can also be reflected in Okta. This functionality enables the use of existing AD groups for managing users within Okta without needing to recreate or manage those group memberships solely within the Okta environment.

Okta is designed to simplify identity and access management while leveraging existing infrastructures like AD. Therefore, administrators can create, modify, and manage AD groups directly in AD, and these changes will sync to Okta according to the directory configuration settings.

Other options may misrepresent the capabilities of the integration. For instance, suggesting that AD groups require exclusive management in Okta overlooks the flexibility that exists in sync operations between the two systems.