Skip to main content
With SCIM (System for Cross-domain Identity Management) provisioning active, your identity provider (IdP) can push its groups into Windmill. Each pushed group becomes a Windmill Group with the same name and members. You can use it anywhere groups are used, like pulse survey audiences and performance review cycles. This article covers how group sync works and how to turn it on in Okta and Microsoft Entra ID. It assumes SCIM provisioning is already active. See Set up SCIM provisioning.

​
How group sync works

  • Groups appear right away. When your identity provider pushes a group, it appears in Settings > Groups immediately. You don’t need to select it from the Available to sync tab. That tab is for groups from Slack, Google Workspace, Microsoft (Outlook), Salesforce, and your HRIS (Human Resources Information System).
  • Names and membership stay in sync. Your identity provider sends changes as they happen. Rename a group or change its members in your identity provider, and Windmill updates within seconds.
  • Only provisioned members count. A group member must already be provisioned into Windmill through SCIM. If someone in the group isn’t assigned to the Windmill app yet, Windmill skips them until they’re provisioned. Your identity provider re-sends the membership after the person is provisioned.
  • Deleting a group archives it. When your identity provider deletes or stops pushing a group, Windmill archives the group and clears its membership. Past pulse surveys and review cycles that used the group keep their history.
  • Sync is one-way. Groups flow from your identity provider into Windmill. Groups you create in Windmill aren’t sent back.
Make group changes in your identity provider, not in Windmill. Windmill doesn’t lock SCIM groups, but the next update from your identity provider can overwrite any change you make in Windmill.

​
Push groups from Okta

Okta pushes groups through the Push Groups tab of the Windmill app. Turn on Push Groups under Provisioning > Integration first. See Set up SCIM with Okta.
1

Assign the group's members to the Windmill app

Okta only sends members who are assigned to the app. The easiest way is to assign the group itself under Assignments > Assign to Groups. This provisions each member into Windmill.
2

Open the Push Groups tab

In the Windmill app, open Push Groups, then select Push Groups > Find groups by name or Find groups by rule.
3

Choose the groups to push

Search for the group and select it. Keep Push group memberships immediately checked. Select Save.
4

Check the push status

The group’s status changes to Active after the push. Open Settings > Groups in Windmill to see the new group and its members.
Okta may show a Link Group option that matches an Okta group to an existing group by name. Windmill only exposes groups that were created through SCIM, so this option links to a previously pushed group, not to a group you created by hand in Windmill.
To stop syncing a group, open its row on the Push Groups tab and choose Unlink pushed group. Choose Delete the group in the target app to archive it in Windmill, or Leave the group in the target app to keep it in Windmill as a group your identity provider no longer updates.

​
Provision groups from Microsoft Entra ID

Entra ID provisions groups that are assigned to the Windmill app, as long as the group mapping is enabled.
1

Confirm group provisioning is enabled

In the Windmill app, open Provisioning > Mappings and check that Provision Microsoft Entra ID Groups is enabled. The default mapping sends the group’s display name and members.
2

Assign the group to the app

Open Users and groups, select Add user/group, and choose the group. Assigning the group also provisions each of its members.
3

Wait for the next provisioning cycle

Entra ID creates the group and its members in the next cycle, about every 40 minutes. Use Provision on demand on the group to push it right away. The group then appears in Settings > Groups.
To stop syncing a group, remove it from Users and groups. Entra ID deletes the group in Windmill on its next cycle, and Windmill archives it. Members who are still assigned to the app individually keep their access.

​
Using synced groups in Windmill

Synced groups work like any other group. You can: See Groups for the steps.

​
FAQs

The missing people aren’t provisioned into Windmill yet. In Okta, assign them to the Windmill app. In Entra ID, add them to the app’s users and groups. Your identity provider re-sends the group membership once they’re provisioned.
That’s expected. SCIM groups skip the Available to sync flow and appear directly in the Groups list as soon as your identity provider pushes them.
Windmill doesn’t block edits, but we don’t recommend them. The next membership update from your identity provider can overwrite your change. Make the change in your identity provider instead.
Yes. SCIM groups, integration groups, and manual groups all live together in Settings > Groups. If two sources supply the same team, give one of them a distinct name so admins can tell them apart.
Windmill archives the group and clears its membership. Members keep their access to Windmill. Past surveys and review cycles that used the group keep their history. Archived groups don’t appear in group pickers.
Yes. When your identity provider deactivates the person, Windmill archives them and they no longer appear in any group’s active member list. Your identity provider usually removes them from the group as well.