### Human: How to Create group rules in Okta? ### Assistant: You can create a group rule to assign a user to groups or exclude them from a group. You can use basic conditions or the Okta Expression Language to create rules. If you're evaluating attributes from Workday, Active Directory, or other sources, you first need to map them to Okta user profile attributes. Create a group rule In the Admin Console, go to DirectoryGroups. Select the Rules tab, and then click Add Rule. Enter a name for the rule. For the IF condition, select one of these options: Use basic condition: Select options from the drop-down lists to create a rule using string attributes only. Use this method to create simple rules. For example, those from a single attribute or from one or more groups only. Use Okta Expression Language (advanced): Select this option to create complex rules with custom expressions. You can create rules using the following: One or more attributes One or more groups Combinations of attributes and groups See About Okta Expression Language. In Then Assign to, enter a single group or multiple groups to which the user should be assigned if the rule condition is met. IMPORTANT: You can assign a user to maximum 100 groups. In Except The following users, enter the names of any users you want to exclude from the rule. IMPORTANT: You can exclude maximum 100 users from a rule. If you manually remove a rule-managed user from a group, that user automatically gets added to Except The following users for that rule. Click Save. After you create and save a rule, it’s inactive by default. Once you activate it, the rule gets applied to your entire org. The new rule then runs on a user as their profile gets updated through import, direct updating, or other changes. The rule doesn't move users in a Pending or Inactive state.


### Human: How to Add a social login (IdP) in Okta? ### Assistant: In the Admin Console, go to SecurityIdentity Providers. Click Add identity provider, and then select a social login (IdP). Follow the setup information for the IdP from Add an external Identity Provider.


### Human: How to Configure an app sign-on policy in Okta? ### Assistant : App sign-on policies allow or restrict access to applications. To set up an app sign-on policy: In the Admin Console, go to ApplicationsApplications. Click the desired app. Click the Sign On tab. Scroll down to the Sign On Policy section. Create a rule: Click Add Rule. Enter a name in the Rule Name field. Decide to whom the rule applies by selecting an option under the People section. Users assigned this app: Specify the users who are assigned this specific app. The following groups and users: Assign the rule to groups or specific users who have been assigned the app. To exclude specific groups and users from the policy rule, select Exclude the following users and groups from this rule. Then specify groups and users. Configure Conditions: Location: Specify the location to which you want the policy to apply. Available options are Anywhere, In Zone, or Not in Zone. If you select In Zone, enter the name of a zone. You configure zone names in Security > Network. See Network zones and Dynamic zones. Client: Choose the conditions that you want to trigger the actions you configure in the Access section: (Microsoft Office 365 apps only.) In If the user's client is any of these, select the client types that you want to trigger the actions you configure in the Actions section (Web browser or Modern Auth client). For details, see the Client section in Office 365 Client Access Policies. In And the user's platform is any of these, select the mobile and/or desktop platforms that you want to trigger the actions you configure in the Access section. Device Trust: Specify the trust status of the device that you want to trigger the actions you configure in the Access section. The Trusted and Not Trusted options are only selectable if Device Trust is configured in Security > Device Trust. Okta Device Trust determines devices to be trusted based on the presence of a trust signal (MDM enrollment; certificate; support for Universal Links). Configure the Actions that you want to enforce based on the conditions you specified in the Conditions section: Access: In the setting When all the conditions above are met, sign on to this application is select either Allowed or Denied. (SAML apps only) Select Prompt for re-authentication and specify how frequently you want users to be prompted to re-authenticate. The time period that you specify begins from the moment the user last authenticated into Okta. Note: A 10-second grace period applies after a user authenticates with their password. During this grace period, users aren't prompted for their password again if Every sign-in attempt is selected under Re-authentication frequency. This feature is available for all SAML-configured apps. Because SWA apps don't support re-authentication, you can't change the sign-on method from SAML to SWA if re-authentication is selected. Select Prompt for factor to require users to choose an MFA option, and specify how frequently you want users to be prompted. The Multifactor Settings link takes you to the Multifactor Authentication page, where you can choose your factors. Click Save.