1. Packages
  2. Okta Provider
  3. API Docs
  4. AppGroupAssignments
Viewing docs for Okta v6.3.1
published on Thursday, Mar 12, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-okta

okta.AppGroupAssignments

okta logo
Viewing docs for Okta v6.3.1
published on Thursday, Mar 12, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-okta

    Assigns groups to an application. This resource allows you to create multiple App Group assignments.

    Important: Do not use for_each on this resource to iterate over groups for the same app_id. This resource’s Read implementation fetches all groups currently assigned to the app from the Okta API — not just the ones declared in config. When multiple instances share the same app_id, the following infinite loop occurs on every apply:

    1. Each instance’s update deletes the groups it does not own from Okta.
    2. Each instance’s Read (called at the end of update) re-fetches all groups from the API and absorbs the other instance’s groups back into state as drift.
    3. State after apply is identical to state before apply — the plan never converges and the same diff reappears on every pulumi preview.

    Since this resource natively supports multiple group blocks, use a dynamic block instead:

    Bad — creates two conflicting resource instances for the same app:

    import * as pulumi from "@pulumi/pulumi";
import * as okta from "@pulumi/okta";
import * as std from "@pulumi/std";

const _this: okta.AppGroupAssignments[] = [];
for (const range = {value: 0}; range.value < std.index.toset({
    input: [
        "group-a",
        "group-b",
    ],
}).result; range.value++) {
    _this.push(new okta.AppGroupAssignments(`this-${range.value}`, {
        appId: thisOktaAppBookmark.id,
        groups: [{
            id: range.value,
        }],
    }));
}

    import pulumi
import pulumi_okta as okta
import pulumi_std as std

this = []
for range in [{"value": i} for i in range(0, std.index.toset(input=[
    group-a,
    group-b,
]).result)]:
    this.append(okta.AppGroupAssignments(f"this-{range['value']}",
        app_id=this_okta_app_bookmark["id"],
        groups=[{
            "id": range["value"],
        }]))

    package main

import (
	"fmt"

	"github.com/pulumi/pulumi-okta/sdk/v6/go/okta"
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		var this []*okta.AppGroupAssignments
		for index := 0; index < std.Toset(ctx, map[string]interface{}{
			"input": []string{
				"group-a",
				"group-b",
			},
		}, nil).Result; index++ {
			key0 := index
			val0 := index
			__res, err := okta.NewAppGroupAssignments(ctx, fmt.Sprintf("this-%v", key0), &okta.AppGroupAssignmentsArgs{
				AppId: pulumi.Any(thisOktaAppBookmark.Id),
				Groups: okta.AppGroupAssignmentsGroupArray{
					&okta.AppGroupAssignmentsGroupArgs{
						Id: pulumi.Any(val0),
					},
				},
			})
			if err != nil {
				return err
			}
			this = append(this, __res)
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Okta = Pulumi.Okta;
using Std = Pulumi.Std;

return await Deployment.RunAsync(() => 
{
    var @this = new List<Okta.AppGroupAssignments>();
    for (var rangeIndex = 0; rangeIndex < Std.Index.Toset.Invoke(new()
    {
        Input = new[]
        {
            "group-a",
            "group-b",
        },
    }).Result; rangeIndex++)
    {
        var range = new { Value = rangeIndex };
        @this.Add(new Okta.AppGroupAssignments($"this-{range.Value}", new()
        {
            AppId = thisOktaAppBookmark.Id,
            Groups = new[]
            {
                new Okta.Inputs.AppGroupAssignmentsGroupArgs
                {
                    Id = range.Value,
                },
            },
        }));
    }
});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.okta.AppGroupAssignments;
import com.pulumi.okta.AppGroupAssignmentsArgs;
import com.pulumi.okta.inputs.AppGroupAssignmentsGroupArgs;
import com.pulumi.codegen.internal.KeyedValue;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        for (var i = 0; i < com.pulumi.std.StdFunctions(Map.of("input", List.of(        
            "group-a",
            "group-b"))).result(); i++) {
            new AppGroupAssignments("this-" + i, AppGroupAssignmentsArgs.builder()
                .appId(thisOktaAppBookmark.id())
                .groups(AppGroupAssignmentsGroupArgs.builder()
                    .id(range.value())
                    .build())
                .build());

        
}
    }
}

    resources:
  this:
    type: okta:AppGroupAssignments
    properties:
      appId: ${thisOktaAppBookmark.id}
      groups:
        - id: ${range.value}
    options: {}

    Good — a single resource instance manages all groups for the app:

    import * as pulumi from "@pulumi/pulumi";
import * as okta from "@pulumi/okta";
import * as std from "@pulumi/std";

const _this = new okta.AppGroupAssignments("this", {
    groups: Object.entries(std.index.toset({
        input: [
            "group-a",
            "group-b",
        ],
    }).result).map(([k, v]) => ({key: k, value: v})).map(entry => ({
        id: entry.value,
    })),
    appId: thisOktaAppBookmark.id,
});

    import pulumi
import pulumi_okta as okta
import pulumi_std as std

this = okta.AppGroupAssignments("this",
    groups=[{
        "id": entry["value"],
    } for entry in [{"key": k, "value": v} for k, v in std.index.toset(input=[
        "group-a",
        "group-b",
    ])["result"].items()]],
    app_id=this_okta_app_bookmark["id"])

    Example coming soon!

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Okta = Pulumi.Okta;
using Std = Pulumi.Std;

return await Deployment.RunAsync(() => 
{
    var @this = new Okta.AppGroupAssignments("this", new()
    {
        Groups = .Select(entry => 
        {
            return new Okta.Inputs.AppGroupAssignmentsGroupArgs
            {
                Id = entry.Value,
            };
        }).ToList(),
        AppId = thisOktaAppBookmark.Id,
    });

});

    Example coming soon!

    Example coming soon!

    Note: Using for_each on this resource is safe when each instance targets a different app_id, for example when assigning the same group to multiple applications.

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as okta from "@pulumi/okta";

const example = new okta.AppGroupAssignments("example", {
    appId: "<app id>",
    groups: [
        {
            id: "<group id>",
            priority: 1,
        },
        {
            id: "<another group id>",
            priority: 2,
            profile: JSON.stringify({
                "application profile field": "application profile value",
            }),
        },
    ],
});

    import pulumi
import json
import pulumi_okta as okta

example = okta.AppGroupAssignments("example",
    app_id="<app id>",
    groups=[
        {
            "id": "<group id>",
            "priority": 1,
        },
        {
            "id": "<another group id>",
            "priority": 2,
            "profile": json.dumps({
                "application profile field": "application profile value",
            }),
        },
    ])

    package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-okta/sdk/v6/go/okta"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"application profile field": "application profile value",
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		_, err = okta.NewAppGroupAssignments(ctx, "example", &okta.AppGroupAssignmentsArgs{
			AppId: pulumi.String("<app id>"),
			Groups: okta.AppGroupAssignmentsGroupArray{
				&okta.AppGroupAssignmentsGroupArgs{
					Id:       pulumi.String("<group id>"),
					Priority: pulumi.Int(1),
				},
				&okta.AppGroupAssignmentsGroupArgs{
					Id:       pulumi.String("<another group id>"),
					Priority: pulumi.Int(2),
					Profile:  pulumi.String(json0),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Okta = Pulumi.Okta;

return await Deployment.RunAsync(() => 
{
    var example = new Okta.AppGroupAssignments("example", new()
    {
        AppId = "<app id>",
        Groups = new[]
        {
            new Okta.Inputs.AppGroupAssignmentsGroupArgs
            {
                Id = "<group id>",
                Priority = 1,
            },
            new Okta.Inputs.AppGroupAssignmentsGroupArgs
            {
                Id = "<another group id>",
                Priority = 2,
                Profile = JsonSerializer.Serialize(new Dictionary<string, object?>
                {
                    ["application profile field"] = "application profile value",
                }),
            },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.okta.AppGroupAssignments;
import com.pulumi.okta.AppGroupAssignmentsArgs;
import com.pulumi.okta.inputs.AppGroupAssignmentsGroupArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AppGroupAssignments("example", AppGroupAssignmentsArgs.builder()
            .appId("<app id>")
            .groups(            
                AppGroupAssignmentsGroupArgs.builder()
                    .id("<group id>")
                    .priority(1)
                    .build(),
                AppGroupAssignmentsGroupArgs.builder()
                    .id("<another group id>")
                    .priority(2)
                    .profile(serializeJson(
                        jsonObject(
                            jsonProperty("application profile field", "application profile value")
                        )))
                    .build())
            .build());

    }
}

    resources:
  example:
    type: okta:AppGroupAssignments
    properties:
      appId: <app id>
      groups:
        - id: <group id>
          priority: 1
        - id: <another group id>
          priority: 2
          profile:
            fn::toJSON:
              application profile field: application profile value

    Create AppGroupAssignments Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new AppGroupAssignments(name: string, args: AppGroupAssignmentsArgs, opts?: CustomResourceOptions);
    @overload
def AppGroupAssignments(resource_name: str,
                        args: AppGroupAssignmentsArgs,
                        opts: Optional[ResourceOptions] = None)

@overload
def AppGroupAssignments(resource_name: str,
                        opts: Optional[ResourceOptions] = None,
                        app_id: Optional[str] = None,
                        groups: Optional[Sequence[AppGroupAssignmentsGroupArgs]] = None)
    func NewAppGroupAssignments(ctx *Context, name string, args AppGroupAssignmentsArgs, opts ...ResourceOption) (*AppGroupAssignments, error)
    public AppGroupAssignments(string name, AppGroupAssignmentsArgs args, CustomResourceOptions? opts = null)
    public AppGroupAssignments(String name, AppGroupAssignmentsArgs args)
public AppGroupAssignments(String name, AppGroupAssignmentsArgs args, CustomResourceOptions options)

    type: okta:AppGroupAssignments
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args AppGroupAssignmentsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args AppGroupAssignmentsArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args AppGroupAssignmentsArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args AppGroupAssignmentsArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args AppGroupAssignmentsArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var appGroupAssignmentsResource = new Okta.AppGroupAssignments("appGroupAssignmentsResource", new()
{
    AppId = "string",
    Groups = new[]
    {
        new Okta.Inputs.AppGroupAssignmentsGroupArgs
        {
            Id = "string",
            Profile = "string",
            Priority = 0,
        },
    },
});

    example, err := okta.NewAppGroupAssignments(ctx, "appGroupAssignmentsResource", &okta.AppGroupAssignmentsArgs{
	AppId: pulumi.String("string"),
	Groups: okta.AppGroupAssignmentsGroupArray{
		&okta.AppGroupAssignmentsGroupArgs{
			Id:       pulumi.String("string"),
			Profile:  pulumi.String("string"),
			Priority: pulumi.Int(0),
		},
	},
})

    var appGroupAssignmentsResource = new AppGroupAssignments("appGroupAssignmentsResource", AppGroupAssignmentsArgs.builder()
    .appId("string")
    .groups(AppGroupAssignmentsGroupArgs.builder()
        .id("string")
        .profile("string")
        .priority(0)
        .build())
    .build());

    app_group_assignments_resource = okta.AppGroupAssignments("appGroupAssignmentsResource",
    app_id="string",
    groups=[{
        "id": "string",
        "profile": "string",
        "priority": 0,
    }])

    const appGroupAssignmentsResource = new okta.AppGroupAssignments("appGroupAssignmentsResource", {
    appId: "string",
    groups: [{
        id: "string",
        profile: "string",
        priority: 0,
    }],
});

    type: okta:AppGroupAssignments
properties:
    appId: string
    groups:
        - id: string
          priority: 0
          profile: string

    AppGroupAssignments Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The AppGroupAssignments resource accepts the following input properties:

    AppId string
    The ID of the application to assign a group to.
    Groups List<AppGroupAssignmentsGroup>
    A group to assign to this application
    AppId string
    The ID of the application to assign a group to.
    Groups []AppGroupAssignmentsGroupArgs
    A group to assign to this application
    appId String
    The ID of the application to assign a group to.
    groups List<AppGroupAssignmentsGroup>
    A group to assign to this application
    appId string
    The ID of the application to assign a group to.
    groups AppGroupAssignmentsGroup[]
    A group to assign to this application
    app_id str
    The ID of the application to assign a group to.
    groups Sequence[AppGroupAssignmentsGroupArgs]
    A group to assign to this application
    appId String
    The ID of the application to assign a group to.
    groups List<Property Map>
    A group to assign to this application

    Outputs

    All input properties are implicitly available as output properties. Additionally, the AppGroupAssignments resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing AppGroupAssignments Resource

    Get an existing AppGroupAssignments resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: AppGroupAssignmentsState, opts?: CustomResourceOptions): AppGroupAssignments
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        app_id: Optional[str] = None,
        groups: Optional[Sequence[AppGroupAssignmentsGroupArgs]] = None) -> AppGroupAssignments
    func GetAppGroupAssignments(ctx *Context, name string, id IDInput, state *AppGroupAssignmentsState, opts ...ResourceOption) (*AppGroupAssignments, error)
    public static AppGroupAssignments Get(string name, Input<string> id, AppGroupAssignmentsState? state, CustomResourceOptions? opts = null)
    public static AppGroupAssignments get(String name, Output<String> id, AppGroupAssignmentsState state, CustomResourceOptions options)
    resources:  _:    type: okta:AppGroupAssignments    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AppId string
    The ID of the application to assign a group to.
    Groups List<AppGroupAssignmentsGroup>
    A group to assign to this application
    AppId string
    The ID of the application to assign a group to.
    Groups []AppGroupAssignmentsGroupArgs
    A group to assign to this application
    appId String
    The ID of the application to assign a group to.
    groups List<AppGroupAssignmentsGroup>
    A group to assign to this application
    appId string
    The ID of the application to assign a group to.
    groups AppGroupAssignmentsGroup[]
    A group to assign to this application
    app_id str
    The ID of the application to assign a group to.
    groups Sequence[AppGroupAssignmentsGroupArgs]
    A group to assign to this application
    appId String
    The ID of the application to assign a group to.
    groups List<Property Map>
    A group to assign to this application

    Supporting Types

    AppGroupAssignmentsGroup, AppGroupAssignmentsGroupArgs

    Id string
    A group to associate with the application
    Profile string
    JSON document containing application profile
    Priority int
    Priority of group assignment
    Id string
    A group to associate with the application
    Profile string
    JSON document containing application profile
    Priority int
    Priority of group assignment
    id String
    A group to associate with the application
    profile String
    JSON document containing application profile
    priority Integer
    Priority of group assignment
    id string
    A group to associate with the application
    profile string
    JSON document containing application profile
    priority number
    Priority of group assignment
    id str
    A group to associate with the application
    profile str
    JSON document containing application profile
    priority int
    Priority of group assignment
    id String
    A group to associate with the application
    profile String
    JSON document containing application profile
    priority Number
    Priority of group assignment

    Import

    $ pulumi import okta:index/appGroupAssignments:AppGroupAssignments example <app_id>

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Okta pulumi/pulumi-okta
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the okta Terraform Provider.
    okta logo
    Viewing docs for Okta v6.3.1
    published on Thursday, Mar 12, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-okta
      Try Pulumi Cloud free. Your team will thank you.