target_group_id drift is not detected for profile enrollment rules

[orlandina]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
  Before submitting a bug report, we ask that you first search existing issues and pull requests to see if someone else may have experienced the same issue or may have already submitted a fix for it. This helps to keep all relevant information in one place, including any potential workarounds.

A Note on Terraform Core Issues

We also ask that you consider whether your issue may be related to Terraform Core. If you are running into one of the following scenarios, we recommend opening an issue in the Terraform Core repository instead:

• Configuration Language or resource ordering issues
• State and State Backend issues
• Provisioner issues
• Registry issues
• Issues that span resources across multiple providers

Terraform Version & Okta Provider Version(s)

Terraform v1.14.6
on darwin_arm64

• provider registry.terraform.io/okta/okta v6.13.0

Affected Resource(s)

okta_policy_rule_profile_enrollment

Can this be done in the Admin UI?

Yes

Can this be done in the actual API call?

Unsure

Customer Information

Organization Name: AutoScout24
Paid Customer: yes

Terraform Configuration

 terraform {
   required_providers {
     okta = {
       source  = "okta/okta"
       version = "~> 6.11"
     }
   }
 }

 resource "okta_group" "registration_users" {
   name        = "Example Registration Users"
   description = "Default group for self-registered users."
 }

 resource "okta_policy_profile_enrollment" "self_service_registration" {
   name   = "Example Self-Service Registration"
   status = "ACTIVE"
 }

 resource "okta_policy_rule_profile_enrollment" "self_service_registration_rule" {
   policy_id           = okta_policy_profile_enrollment.self_service_registration.id
   unknown_user_action = "REGISTER"
   email_verification  = true
   access              = "ALLOW"

   target_group_id = okta_group.registration_users.id

   profile_attributes {
     name     = "email"
     label    = "Email"
     required = true
   }
 }

Debug Output

okta_policy_rule_profile_enrollment.self_service_registration_rule: Refreshing state... [id=<profile_enrollment_rule_id>]

No changes. Your infrastructure matches the configuration.

The missing drift is that the remote profile enrollment rule no longer has the configured target_group_id, but Terraform still reports no changes.

Expected Behavior

After the target group is removed from the profile enrollment rule in the Okta Admin UI, Terraform should detect drift during refresh.

terraform plan should show that target_group_id differs from the configured value and should plan an update to restore it:

target_group_id = okta_group.registration_users.id

terraform apply should then update the remote profile enrollment rule and re-add the configured target group.

Actual Behavior

After removing the target group from the profile enrollment rule in the Okta Admin UI, Terraform does not detect any drift.

terraform plan reports:

No changes. Your infrastructure matches the configuration.

terraform apply also does not restore the configured target_group_id.

The Terraform configuration still contains target_group_id, but the remote Okta profile enrollment rule no longer has that target group assigned.

Steps to reproduce

1. Apply a configuration that creates:

   • an okta_group
   • an okta_policy_profile_enrollment
   • an okta_policy_rule_profile_enrollment with target_group_id set to the group ID

2. Confirm in the Okta Admin UI that the profile enrollment rule has the target group assigned.

3. In the Okta Admin UI, edit the profile enrollment rule and remove the target group.

4. Run:

terraform plan

5. Observe that Terraform reports no changes.
6. Optional: run:

terraform apply

7. Observe that Terraform still does not restore the configured target_group_id.

Important Factoids

No response

References

No response