The following is a summary of questions and answers from the Okta Workflows community office hours on Thursday, April 17, 2025. I edit questions for clarity. Read past office hours’ questions and answers.

Office hours questions and answers

I have a workflow that runs before newly created users are added to groups and set a custom profile attribute. However, a race condition prevents this from happening most of the time. Instead, I would like to wait a minute after a user is created, set their custom attribute, get a list of all their groups and the AD (Active Directory) application, remove them from all the groups and the AD application, and then add them to the groups (which should automatically add them to AD application.)

One possible solution looks like this:

• Run a flow when a new user is created.
  • Right away, wait for several minutes (Flow Control – Wait For card) to give enough time for the user to be added to groups.
• Save to a Workflows table all the groups to which this user belongs.
• Remove the user from all the groups to which this user belongs.
• Set the custom profile attribute.
• Add the user to all the groups in the table.

One caveat to this approach is that removal from a group could trigger application deprovisioning.

Another solution is to create a new custom attribute, mark it as required, and define a set of values from which the user has to choose. Since the attribute requires a value, it will force whoever creates a new user to select a value for this attribute.

Okta Workflows resources

🚀 New to Okta Workflows? The Getting Started with Okta Workflows page has all the resources to help you get started.

📺 Like learning from videos? Watch Okta Workflows videos.

❓Have a question? Ask during community office hours, post on the community forum, or email me.

🙋🏻‍♀️ Want to learn from the community? Join the #okta-workflows channel on the MacAdmins Slack.

📖 Want to learn more about identity automation? Take Workflows training on Okta Learning.