published on Thursday, Mar 12, 2026 by Pulumi
published on Thursday, Mar 12, 2026 by Pulumi
Creates a Push Group assignment for an Application in Okta.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as okta from "@pulumi/okta";
const test = new okta.app.Swa("test", {
appLinksJson: JSON.stringify({
deelhr_link: true,
}),
label: "Deel HR",
preconfiguredApp: "deelhr",
status: "ACTIVE",
userNameTemplateType: "BUILT_IN",
});
const testGroup = new okta.group.Group("test", {name: "Some Test Push Group"});
const sample = new okta.PushGroup("sample", {
appId: test.id,
sourceGroupId: testGroup.id,
status: "ACTIVE",
deleteTargetGroupOnDestroy: true,
});
const adSample = new okta.PushGroup("ad_sample", {
appId: test.id,
sourceGroupId: testGroup.id,
status: "ACTIVE",
appConfig: {
distinguishedName: "CN=Test,OU=Groups,DC=example,DC=com",
groupScope: "DOMAIN_LOCAL",
groupType: "SECURITY",
samAccountName: "something",
},
});
import pulumi
import json
import pulumi_okta as okta
test = okta.app.Swa("test",
app_links_json=json.dumps({
"deelhr_link": True,
}),
label="Deel HR",
preconfigured_app="deelhr",
status="ACTIVE",
user_name_template_type="BUILT_IN")
test_group = okta.group.Group("test", name="Some Test Push Group")
sample = okta.PushGroup("sample",
app_id=test.id,
source_group_id=test_group.id,
status="ACTIVE",
delete_target_group_on_destroy=True)
ad_sample = okta.PushGroup("ad_sample",
app_id=test.id,
source_group_id=test_group.id,
status="ACTIVE",
app_config={
"distinguished_name": "CN=Test,OU=Groups,DC=example,DC=com",
"group_scope": "DOMAIN_LOCAL",
"group_type": "SECURITY",
"sam_account_name": "something",
})
package main
import (
"encoding/json"
"github.com/pulumi/pulumi-okta/sdk/v6/go/okta"
"github.com/pulumi/pulumi-okta/sdk/v6/go/okta/app"
"github.com/pulumi/pulumi-okta/sdk/v6/go/okta/group"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
tmpJSON0, err := json.Marshal(map[string]interface{}{
"deelhr_link": true,
})
if err != nil {
return err
}
json0 := string(tmpJSON0)
test, err := app.NewSwa(ctx, "test", &app.SwaArgs{
AppLinksJson: pulumi.String(json0),
Label: pulumi.String("Deel HR"),
PreconfiguredApp: pulumi.String("deelhr"),
Status: pulumi.String("ACTIVE"),
UserNameTemplateType: pulumi.String("BUILT_IN"),
})
if err != nil {
return err
}
testGroup, err := group.NewGroup(ctx, "test", &group.GroupArgs{
Name: pulumi.String("Some Test Push Group"),
})
if err != nil {
return err
}
_, err = okta.NewPushGroup(ctx, "sample", &okta.PushGroupArgs{
AppId: test.ID(),
SourceGroupId: testGroup.ID(),
Status: pulumi.String("ACTIVE"),
DeleteTargetGroupOnDestroy: pulumi.Bool(true),
})
if err != nil {
return err
}
_, err = okta.NewPushGroup(ctx, "ad_sample", &okta.PushGroupArgs{
AppId: test.ID(),
SourceGroupId: testGroup.ID(),
Status: pulumi.String("ACTIVE"),
AppConfig: &okta.PushGroupAppConfigArgs{
DistinguishedName: pulumi.String("CN=Test,OU=Groups,DC=example,DC=com"),
GroupScope: pulumi.String("DOMAIN_LOCAL"),
GroupType: pulumi.String("SECURITY"),
SamAccountName: pulumi.String("something"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Okta = Pulumi.Okta;
return await Deployment.RunAsync(() =>
{
var test = new Okta.App.Swa("test", new()
{
AppLinksJson = JsonSerializer.Serialize(new Dictionary<string, object?>
{
["deelhr_link"] = true,
}),
Label = "Deel HR",
PreconfiguredApp = "deelhr",
Status = "ACTIVE",
UserNameTemplateType = "BUILT_IN",
});
var testGroup = new Okta.Group.Group("test", new()
{
Name = "Some Test Push Group",
});
var sample = new Okta.PushGroup("sample", new()
{
AppId = test.Id,
SourceGroupId = testGroup.Id,
Status = "ACTIVE",
DeleteTargetGroupOnDestroy = true,
});
var adSample = new Okta.PushGroup("ad_sample", new()
{
AppId = test.Id,
SourceGroupId = testGroup.Id,
Status = "ACTIVE",
AppConfig = new Okta.Inputs.PushGroupAppConfigArgs
{
DistinguishedName = "CN=Test,OU=Groups,DC=example,DC=com",
GroupScope = "DOMAIN_LOCAL",
GroupType = "SECURITY",
SamAccountName = "something",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.okta.app.Swa;
import com.pulumi.okta.app.SwaArgs;
import com.pulumi.okta.group.Group;
import com.pulumi.okta.group.GroupArgs;
import com.pulumi.okta.PushGroup;
import com.pulumi.okta.PushGroupArgs;
import com.pulumi.okta.inputs.PushGroupAppConfigArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var test = new Swa("test", SwaArgs.builder()
.appLinksJson(serializeJson(
jsonObject(
jsonProperty("deelhr_link", true)
)))
.label("Deel HR")
.preconfiguredApp("deelhr")
.status("ACTIVE")
.userNameTemplateType("BUILT_IN")
.build());
var testGroup = new Group("testGroup", GroupArgs.builder()
.name("Some Test Push Group")
.build());
var sample = new PushGroup("sample", PushGroupArgs.builder()
.appId(test.id())
.sourceGroupId(testGroup.id())
.status("ACTIVE")
.deleteTargetGroupOnDestroy(true)
.build());
var adSample = new PushGroup("adSample", PushGroupArgs.builder()
.appId(test.id())
.sourceGroupId(testGroup.id())
.status("ACTIVE")
.appConfig(PushGroupAppConfigArgs.builder()
.distinguishedName("CN=Test,OU=Groups,DC=example,DC=com")
.groupScope("DOMAIN_LOCAL")
.groupType("SECURITY")
.samAccountName("something")
.build())
.build());
}
}
resources:
test:
type: okta:app:Swa
properties:
appLinksJson:
fn::toJSON:
deelhr_link: true
label: Deel HR
preconfiguredApp: deelhr
status: ACTIVE
userNameTemplateType: BUILT_IN
testGroup:
type: okta:group:Group
name: test
properties:
name: Some Test Push Group
sample:
type: okta:PushGroup
properties:
appId: ${test.id}
sourceGroupId: ${testGroup.id}
status: ACTIVE
deleteTargetGroupOnDestroy: true
adSample:
type: okta:PushGroup
name: ad_sample
properties:
appId: ${test.id}
sourceGroupId: ${testGroup.id}
status: ACTIVE
appConfig:
distinguishedName: CN=Test,OU=Groups,DC=example,DC=com
groupScope: DOMAIN_LOCAL
groupType: SECURITY
samAccountName: something
Create PushGroup Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new PushGroup(name: string, args: PushGroupArgs, opts?: CustomResourceOptions);@overload
def PushGroup(resource_name: str,
args: PushGroupArgs,
opts: Optional[ResourceOptions] = None)
@overload
def PushGroup(resource_name: str,
opts: Optional[ResourceOptions] = None,
app_id: Optional[str] = None,
source_group_id: Optional[str] = None,
app_config: Optional[PushGroupAppConfigArgs] = None,
delete_target_group_on_destroy: Optional[bool] = None,
status: Optional[str] = None,
target_group_id: Optional[str] = None,
target_group_name: Optional[str] = None)func NewPushGroup(ctx *Context, name string, args PushGroupArgs, opts ...ResourceOption) (*PushGroup, error)public PushGroup(string name, PushGroupArgs args, CustomResourceOptions? opts = null)
public PushGroup(String name, PushGroupArgs args)
public PushGroup(String name, PushGroupArgs args, CustomResourceOptions options)
type: okta:PushGroup
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args PushGroupArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args PushGroupArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args PushGroupArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args PushGroupArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args PushGroupArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var pushGroupResource = new Okta.PushGroup("pushGroupResource", new()
{
AppId = "string",
SourceGroupId = "string",
AppConfig = new Okta.Inputs.PushGroupAppConfigArgs
{
DistinguishedName = "string",
GroupScope = "string",
GroupType = "string",
SamAccountName = "string",
},
DeleteTargetGroupOnDestroy = false,
Status = "string",
TargetGroupId = "string",
TargetGroupName = "string",
});
example, err := okta.NewPushGroup(ctx, "pushGroupResource", &okta.PushGroupArgs{
AppId: pulumi.String("string"),
SourceGroupId: pulumi.String("string"),
AppConfig: &okta.PushGroupAppConfigArgs{
DistinguishedName: pulumi.String("string"),
GroupScope: pulumi.String("string"),
GroupType: pulumi.String("string"),
SamAccountName: pulumi.String("string"),
},
DeleteTargetGroupOnDestroy: pulumi.Bool(false),
Status: pulumi.String("string"),
TargetGroupId: pulumi.String("string"),
TargetGroupName: pulumi.String("string"),
})
var pushGroupResource = new PushGroup("pushGroupResource", PushGroupArgs.builder()
.appId("string")
.sourceGroupId("string")
.appConfig(PushGroupAppConfigArgs.builder()
.distinguishedName("string")
.groupScope("string")
.groupType("string")
.samAccountName("string")
.build())
.deleteTargetGroupOnDestroy(false)
.status("string")
.targetGroupId("string")
.targetGroupName("string")
.build());
push_group_resource = okta.PushGroup("pushGroupResource",
app_id="string",
source_group_id="string",
app_config={
"distinguished_name": "string",
"group_scope": "string",
"group_type": "string",
"sam_account_name": "string",
},
delete_target_group_on_destroy=False,
status="string",
target_group_id="string",
target_group_name="string")
const pushGroupResource = new okta.PushGroup("pushGroupResource", {
appId: "string",
sourceGroupId: "string",
appConfig: {
distinguishedName: "string",
groupScope: "string",
groupType: "string",
samAccountName: "string",
},
deleteTargetGroupOnDestroy: false,
status: "string",
targetGroupId: "string",
targetGroupName: "string",
});
type: okta:PushGroup
properties:
appConfig:
distinguishedName: string
groupScope: string
groupType: string
samAccountName: string
appId: string
deleteTargetGroupOnDestroy: false
sourceGroupId: string
status: string
targetGroupId: string
targetGroupName: string
PushGroup Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The PushGroup resource accepts the following input properties:
- App
Id string - The ID of the Okta Application.
- Source
Group stringId - The ID of the source group in Okta.
- App
Config PushGroup App Config - Additional app configuration for group push mappings. Currently only required for Active Directory.
- Delete
Target boolGroup On Destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- Status string
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - Target
Group stringId - The ID of the target group.
- Target
Group stringName - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
- App
Id string - The ID of the Okta Application.
- Source
Group stringId - The ID of the source group in Okta.
- App
Config PushGroup App Config Args - Additional app configuration for group push mappings. Currently only required for Active Directory.
- Delete
Target boolGroup On Destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- Status string
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - Target
Group stringId - The ID of the target group.
- Target
Group stringName - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
- app
Id String - The ID of the Okta Application.
- source
Group StringId - The ID of the source group in Okta.
- app
Config PushGroup App Config - Additional app configuration for group push mappings. Currently only required for Active Directory.
- delete
Target BooleanGroup On Destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- status String
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - target
Group StringId - The ID of the target group.
- target
Group StringName - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
- app
Id string - The ID of the Okta Application.
- source
Group stringId - The ID of the source group in Okta.
- app
Config PushGroup App Config - Additional app configuration for group push mappings. Currently only required for Active Directory.
- delete
Target booleanGroup On Destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- status string
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - target
Group stringId - The ID of the target group.
- target
Group stringName - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
- app_
id str - The ID of the Okta Application.
- source_
group_ strid - The ID of the source group in Okta.
- app_
config PushGroup App Config Args - Additional app configuration for group push mappings. Currently only required for Active Directory.
- delete_
target_ boolgroup_ on_ destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- status str
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - target_
group_ strid - The ID of the target group.
- target_
group_ strname - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
- app
Id String - The ID of the Okta Application.
- source
Group StringId - The ID of the source group in Okta.
- app
Config Property Map - Additional app configuration for group push mappings. Currently only required for Active Directory.
- delete
Target BooleanGroup On Destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- status String
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - target
Group StringId - The ID of the target group.
- target
Group StringName - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
Outputs
All input properties are implicitly available as output properties. Additionally, the PushGroup resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing PushGroup Resource
Get an existing PushGroup resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: PushGroupState, opts?: CustomResourceOptions): PushGroup@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
app_config: Optional[PushGroupAppConfigArgs] = None,
app_id: Optional[str] = None,
delete_target_group_on_destroy: Optional[bool] = None,
source_group_id: Optional[str] = None,
status: Optional[str] = None,
target_group_id: Optional[str] = None,
target_group_name: Optional[str] = None) -> PushGroupfunc GetPushGroup(ctx *Context, name string, id IDInput, state *PushGroupState, opts ...ResourceOption) (*PushGroup, error)public static PushGroup Get(string name, Input<string> id, PushGroupState? state, CustomResourceOptions? opts = null)public static PushGroup get(String name, Output<String> id, PushGroupState state, CustomResourceOptions options)resources: _: type: okta:PushGroup get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- App
Config PushGroup App Config - Additional app configuration for group push mappings. Currently only required for Active Directory.
- App
Id string - The ID of the Okta Application.
- Delete
Target boolGroup On Destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- Source
Group stringId - The ID of the source group in Okta.
- Status string
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - Target
Group stringId - The ID of the target group.
- Target
Group stringName - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
- App
Config PushGroup App Config Args - Additional app configuration for group push mappings. Currently only required for Active Directory.
- App
Id string - The ID of the Okta Application.
- Delete
Target boolGroup On Destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- Source
Group stringId - The ID of the source group in Okta.
- Status string
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - Target
Group stringId - The ID of the target group.
- Target
Group stringName - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
- app
Config PushGroup App Config - Additional app configuration for group push mappings. Currently only required for Active Directory.
- app
Id String - The ID of the Okta Application.
- delete
Target BooleanGroup On Destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- source
Group StringId - The ID of the source group in Okta.
- status String
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - target
Group StringId - The ID of the target group.
- target
Group StringName - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
- app
Config PushGroup App Config - Additional app configuration for group push mappings. Currently only required for Active Directory.
- app
Id string - The ID of the Okta Application.
- delete
Target booleanGroup On Destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- source
Group stringId - The ID of the source group in Okta.
- status string
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - target
Group stringId - The ID of the target group.
- target
Group stringName - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
- app_
config PushGroup App Config Args - Additional app configuration for group push mappings. Currently only required for Active Directory.
- app_
id str - The ID of the Okta Application.
- delete_
target_ boolgroup_ on_ destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- source_
group_ strid - The ID of the source group in Okta.
- status str
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - target_
group_ strid - The ID of the target group.
- target_
group_ strname - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
- app
Config Property Map - Additional app configuration for group push mappings. Currently only required for Active Directory.
- app
Id String - The ID of the Okta Application.
- delete
Target BooleanGroup On Destroy - Whether to delete the target group when the push group mapping is destroyed. Default is true.
- source
Group StringId - The ID of the source group in Okta.
- status String
- The status of the push group mapping. Valid values:
ACTIVEandINACTIVE - target
Group StringId - The ID of the target group.
- target
Group StringName - The name of the target group for the group push mapping. This is used when creating a new downstream group. If the group already exists, it links to the existing group. If not specified, the name of the source group will be used as the name of the target group. Setting a target group name only works if you have unchecked 'Rename app groups to match group name in Okta' in the push groups settings UI.
Supporting Types
PushGroupAppConfig, PushGroupAppConfigArgs
- Distinguished
Name string - Group
Scope string - Group
Type string - Sam
Account stringName
- Distinguished
Name string - Group
Scope string - Group
Type string - Sam
Account stringName
- distinguished
Name String - group
Scope String - group
Type String - sam
Account StringName
- distinguished
Name string - group
Scope string - group
Type string - sam
Account stringName
- distinguished_
name str - group_
scope str - group_
type str - sam_
account_ strname
- distinguished
Name String - group
Scope String - group
Type String - sam
Account StringName
Import
$ pulumi import okta:index/pushGroup:PushGroup example <app_id>/<push_group_mapping_id>
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Okta pulumi/pulumi-okta
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
oktaTerraform Provider.
published on Thursday, Mar 12, 2026 by Pulumi
