Which type of groups in Okta cannot contain members from multiple domains?

In Okta, Domain Local Groups are specifically designed to include members from only a single domain. They are used primarily for assigning permissions to resources within that domain. This characteristic makes Domain Local Groups distinct, as they cannot have members from multiple domains, limiting their scope and functionality to the users and resources of the domain they belong to.

This approach contrasts with other group types, such as Active Directory Groups and Universal Security Groups, which can encompass members from multiple domains. Active Directory Groups are part of the broader Active Directory environment and allow for cross-domain membership, while Universal Security Groups are designed for use in multi-domain scenarios, facilitating access to resources beyond the confines of a single domain.

Native Okta Groups can include any users from the Okta organization and do not have the same domain restrictions, allowing greater flexibility. Hence, Domain Local Groups are the only type that cannot contain members from multiple domains, affirming their limited scope and purpose.

This characteristic is crucial for organizations that manage users and resources across different domains, as it influences how access and permissions are structured and managed within a multi-domain environment. Understanding this limitation helps in effectively designing security and group management strategies within Okta.