# Okta Workforce Enterprise Groups Assigning Roles

**URL:** <https://community.auth0.com/t/okta-workforce-enterprise-groups-assigning-roles/204813>\
**Category:** Get Help\
**Tags:** enterprise-connections, post-login, roles-assignment\
**Created:** [October 28, 2026, 8:58pm UTC](https://community.auth0.com/t/okta-workforce-enterprise-groups-assigning-roles/204813 "2026-10-28T20:58:28Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![nik.baleca](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nik.baleca/32/68749_2.png) [@nik.baleca](https://community.auth0.com/u/nik.baleca)\
**Post date:** [October 28, 2026, 11:21pm UTC](https://community.auth0.com/t/okta-workforce-enterprise-groups-assigning-roles/204813/3 "2026-10-28T23:21:29Z")

</div>

Hi @iris-technology

Welcome to the Auth0 Community!

You are asking how to correct the Post-Login Action guidance for your Okta Workforce Enterprise connection, so that group information from Okta is available to your Action and is not confused with Auth0 RBAC roles.

**Summary:** Group membership from Okta reaches Auth0 only when the Okta application sends a `groups` claim, and Auth0 stores that value as `federated_groups` on the user, which is separate from the RBAC roles returned in `event.authorization.roles`.

**Root Cause:** Auth0 can receive group values from Okta only if the Okta application includes a `groups` claim in the ID token. When the claim is missing or filtered out, the user record does not contain `federated_groups`, even though the connection mapping lists it. Group membership and Auth0 RBAC roles are also separate objects, so a role assigned to a group does not automatically appear in `event.authorization.roles`.

**Solution:** Confirm that Okta sends the `groups` claim, then read `federated_groups` from the user in your Action.

1. **Open** the Okta application that connects to Auth0, then select the **Sign On** tab.
2. **Edit** the OpenID Connect ID Token settings, and set the **Group Claims Filter** to the name `groups`.
3. **Select** the **Matches regex** option and enter `.*` to return all groups. If the regex option returns no groups in your Okta organization, **change** the filter to an expression such as `Groups.startsWith("your_prefix", "", 100)`.
4. **Sign in** through the Okta connection again, then **check** the user's raw JSON in the Auth0 Dashboard for a `federated_groups` value.
5. **Read** the `federated_groups` value in your Post-Login Action. The value arrives as a string, so **split** it on the delimiter your Okta filter uses before you compare individual groups.
6. **Map** any group that must grant access to an Auth0 role in a separate step, using the Management API call described in the earlier guidance. Federated group values alone do not add RBAC roles.

- [Auth0 Community: Okta Workforce Enterprise SSO Groups Clarification](https://community.auth0.com/t/okta-workforce-entreprise-sso-groups-clarification/183455) (explains the Okta Sign On tab group claim setting and the regex filter, and that the groups arrive as a string)

We hope these steps help you confirm the group values in your Action.

Kind Regards,  
Nik

---

_[View the full topic](https://community.auth0.com/t/okta-workforce-enterprise-groups-assigning-roles/204813)._