> ## Documentation Index
> Fetch the complete documentation index at: https://help.gowindmill.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sync Groups from Your Identity Provider

> Push groups from Okta or Microsoft Entra ID into Windmill Groups through SCIM so you can target pulse surveys and performance review cycles without maintaining group membership by hand.

With SCIM (System for Cross-domain Identity Management) provisioning active, your identity provider (IdP) can push its groups into Windmill. Each pushed group becomes a [Windmill Group](/org-chart/groups) with the same name and members. You can use it anywhere groups are used, like pulse survey audiences and performance review cycles.

This article covers how group sync works and how to turn it on in Okta and Microsoft Entra ID. It assumes SCIM provisioning is already active. See [Set up SCIM provisioning](/security/sso-and-scim#set-up-scim-provisioning).

## How group sync works

* **Groups appear right away.** When your identity provider pushes a group, it appears in [**Settings > Groups**](https://app.gowindmill.com/COMPANY/config/groups) immediately. You don't need to select it from the **Available to sync** tab. That tab is for groups from Slack, Google Workspace, Microsoft (Outlook), Salesforce, and your HRIS (Human Resources Information System).
* **Names and membership stay in sync.** Your identity provider sends changes as they happen. Rename a group or change its members in your identity provider, and Windmill updates within seconds.
* **Only provisioned members count.** A group member must already be provisioned into Windmill through SCIM. If someone in the group isn't assigned to the Windmill app yet, Windmill skips them until they're provisioned. Your identity provider re-sends the membership after the person is provisioned.
* **Deleting a group archives it.** When your identity provider deletes or stops pushing a group, Windmill archives the group and clears its membership. Past pulse surveys and review cycles that used the group keep their history.
* **Sync is one-way.** Groups flow from your identity provider into Windmill. Groups you create in Windmill aren't sent back.

<Warning>
  Make group changes in your identity provider, not in Windmill. Windmill doesn't lock SCIM groups, but the next update from your identity provider can overwrite any change you make in Windmill.
</Warning>

## Push groups from Okta

Okta pushes groups through the **Push Groups** tab of the Windmill app. Turn on **Push Groups** under **Provisioning > Integration** first. See [Set up SCIM with Okta](/security/scim-okta#turn-on-provisioning).

<Steps>
  <Step title="Assign the group's members to the Windmill app">
    Okta only sends members who are assigned to the app. The easiest way is to assign the group itself under **Assignments > Assign to Groups**. This provisions each member into Windmill.
  </Step>

  <Step title="Open the Push Groups tab">
    In the Windmill app, open **Push Groups**, then select **Push Groups > Find groups by name** or **Find groups by rule**.
  </Step>

  <Step title="Choose the groups to push">
    Search for the group and select it. Keep **Push group memberships immediately** checked. Select **Save**.
  </Step>

  <Step title="Check the push status">
    The group's status changes to **Active** after the push. Open [**Settings > Groups**](https://app.gowindmill.com/COMPANY/config/groups) in Windmill to see the new group and its members.
  </Step>
</Steps>

<Note>
  Okta may show a **Link Group** option that matches an Okta group to an existing group by name. Windmill only exposes groups that were created through SCIM, so this option links to a previously pushed group, not to a group you created by hand in Windmill.
</Note>

To stop syncing a group, open its row on the **Push Groups** tab and choose **Unlink pushed group**. Choose **Delete the group in the target app** to archive it in Windmill, or **Leave the group in the target app** to keep it in Windmill as a group your identity provider no longer updates.

## Provision groups from Microsoft Entra ID

Entra ID provisions groups that are assigned to the Windmill app, as long as the group mapping is enabled.

<Steps>
  <Step title="Confirm group provisioning is enabled">
    In the Windmill app, open **Provisioning > Mappings** and check that **Provision Microsoft Entra ID Groups** is enabled. The default mapping sends the group's display name and members.
  </Step>

  <Step title="Assign the group to the app">
    Open **Users and groups**, select **Add user/group**, and choose the group. Assigning the group also provisions each of its members.
  </Step>

  <Step title="Wait for the next provisioning cycle">
    Entra ID creates the group and its members in the next cycle, about every 40 minutes. Use **Provision on demand** on the group to push it right away. The group then appears in [**Settings > Groups**](https://app.gowindmill.com/COMPANY/config/groups).
  </Step>
</Steps>

To stop syncing a group, remove it from **Users and groups**. Entra ID deletes the group in Windmill on its next cycle, and Windmill archives it. Members who are still assigned to the app individually keep their access.

## Using synced groups in Windmill

Synced groups work like any other group. You can:

* Target them as the audience for a [pulse survey](/features/pulse-surveys)
* Choose them as participants in a [performance review cycle](/features/performance-reviews/cycles)
* Filter by them in reports and the org chart

See [Groups](/org-chart/groups#using-groups) for the steps.

## FAQs

<AccordionGroup>
  <Accordion title="Some group members are missing in Windmill.">
    The missing people aren't provisioned into Windmill yet. In Okta, assign them to the Windmill app. In Entra ID, add them to the app's users and groups. Your identity provider re-sends the group membership once they're provisioned.
  </Accordion>

  <Accordion title="I don't see my identity provider group in the Available to sync tab.">
    That's expected. SCIM groups skip the **Available to sync** flow and appear directly in the Groups list as soon as your identity provider pushes them.
  </Accordion>

  <Accordion title="Can I edit a synced group in Windmill?">
    Windmill doesn't block edits, but we don't recommend them. The next membership update from your identity provider can overwrite your change. Make the change in your identity provider instead.
  </Accordion>

  <Accordion title="Can I use identity provider groups alongside groups from my HRIS or Slack?">
    Yes. SCIM groups, integration groups, and manual groups all live together in [**Settings > Groups**](https://app.gowindmill.com/COMPANY/config/groups). If two sources supply the same team, give one of them a distinct name so admins can tell them apart.
  </Accordion>

  <Accordion title="What happens when I delete a group in my identity provider?">
    Windmill archives the group and clears its membership. Members keep their access to Windmill. Past surveys and review cycles that used the group keep their history. Archived groups don't appear in group pickers.
  </Accordion>

  <Accordion title="A member left the company. Are they removed from synced groups?">
    Yes. When your identity provider deactivates the person, Windmill archives them and they no longer appear in any group's active member list. Your identity provider usually removes them from the group as well.
  </Accordion>
</AccordionGroup>