We use Okta and Slack Enterprise Grid, and requests to add people to Slack user groups are piling up. Group management reportedly stopped working after the move to Grid.
Is it better to push groups from Okta or manage the tags through the Slack API? We also onboard people in batches, so I'm concerned about membership updates overwriting each other.
I'd check Okta group push first and verify how the pushed groups map to your Grid workspaces. That may give you a way to maintain membership in Okta rather than handling each tag request manually in Slack.
Keep the group that assigns Slack access separate from the group used to push membership. Otherwise, a user can be added to the push group before their Slack account has been provisioned.
The API route gives you more control if your onboarding automation already knows who belongs in each group. Use Okta or another source of truth to calculate membership, then update Slack after users have been provisioned. Offboarding should trigger the same kind of update.
For an update that replaces the full membership list, fetching the current members and merging in new users avoids simply dropping everyone else. But two jobs can still fetch the same old list and overwrite each other's changes. Serialize updates per group, or use a reconciliation job that recalculates the desired membership from the source of truth.
++neatly~outdated:
That concurrency issue matters for bulk onboarding. A read and merge helps with one update, but it isn't enough by itself when several updates run at once.
Before replacing anything, test one existing tag and one new pushed group with a few provisioned users. Check whether the result is the Slack user group people can actually mention, not just a group that grants workspace access. Then you can work out how to migrate the existing tags without disrupting them.
Answers are reviewed before publication.
mostly_sideways:
That sounds worth checking. We currently grant Slack access through an automatic group, so provisioning order could be part of the problem.
y501+cfgload_8:
Also check whether the groups you need are at the organization or workspace level. The move to Grid may have changed which groups are available where.